EU high-risk rules moved. Transparency already applies.

AI regulations for B2B companies depend on the system, its use and the markets it reaches. This guide separates binding duties from voluntary frameworks and shows reviewed dates with primary sources. Use it to identify applicable requirements, then connect them to ownership, records and controls in the workflow. See AI governance consulting.

Download the playbookScope a regulatory diagnostic
AI agents carry documents through three glass gates while a person watches.

Which rules apply to you?

FrameworkApplies toStatusDo nowDeep dive
EU AI ActAI on the EU market or affecting EU usersLaw · phased rolloutCheck scope.Open
NIST AI RMFUS procurement and enterprise expectationsVoluntary guidanceCheck buyer needs.Open
ISO/IEC 42001Organizations that develop, provide, or use AICertifiable standardCheck scope.Open
UK AI FrameworkAI in UK-regulated sectorsRegulator-led guidanceCheck buyer needs.Open
Singapore Model AIAI teams in Singapore and APACVoluntary frameworkCheck buyer needs.Open
Canada AIDA (died January 2025)AIDA withdrawn. Separate rules may applyWithdrawn · not enactedDo not apply AIDA.Open

Six global regimes.

EU AI Act

European Union Artificial Intelligence Act

European Union, 27 member states · eu · critical

Status

phased-rollout

Effective date

Prohibited practices: Feb 2, 2025. GPAI obligations: Aug 2, 2025. Article 50 transparency: Aug 2, 2026. Older-system marking and two new Article 5 bans: Dec 2, 2026. Annex III high-risk: Dec 2, 2027. Annex I high-risk: Aug 2, 2028, under Regulation (EU) 2026/1744.

Scope

Any AI system placed on the EU market or whose output affects people in the EU. Extraterritorial. Applies whether your headquarters is in the EU or not.

Penalty exposure

Up to €35M or 7% of global annual turnover for prohibited practices. Up to €15M or 3% for high-risk violations. Up to €7.5M or 1.5% for incorrect information to authorities.

What triggers it

  • You sell, distribute, or operate an AI system in the EU.
  • Your AI output is used in the EU even if hosted elsewhere.
  • You provide a general-purpose AI model above 10^25 FLOPs.
  • You operate a high-risk AI system listed in Annex III (HR, credit, education, critical infrastructure, law enforcement, migration, biometric ID).

Obligations

  • Risk classification and Annex III determination.
  • Conformity assessment before market entry for high-risk systems.
  • Technical documentation, post-market monitoring, incident reporting within 15 days.
  • Human oversight provisions and transparency disclosures.
  • Article 49(1): providers register Annex III high-risk AI systems in the EU database before placing them on the market or putting them into service. Annex III point 2 systems, covering critical infrastructure, are registered at national level under Article 49(5).
  • Article 49(2): a provider that concludes under Article 6(3) that an Annex III system is not high-risk must still register that system. Regulation (EU) 2026/1744 simplified the information required for this registration, as explained in Recital 22. The provider must document the Article 6(3) assessment before placing the system on the market and show it to national authorities on request.
  • Article 49(3): deployers that are public authorities, EU institutions, bodies, offices or agencies, or persons acting on their behalf, register their use of an Annex III high-risk system. Other deployers do not register. The national-level route for Annex III point 2 remains separate.
  • Article 49(4): Annex III points 1, 6 and 7, covering biometrics, law enforcement, migration, asylum and border control, are registered in a secure non-public section of the database.
  • Annex III high-risk obligations apply from December 2, 2027.

Evidence

  • Risk management system documentation.
  • Data governance procedures (training, validation, testing).
  • Quality management system records.
  • Logs covering the lifetime of the high-risk system.
  • EU declaration of conformity.

Primary source: Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744.

NIST AI RMF

NIST AI Risk Management Framework 1.0 + AI 600-1 GenAI Profile

United States, federal guidance · us-federal · high

Status

guidance

Effective date

AI RMF 1.0 published Jan 2023. AI 600-1 GenAI Profile published Jul 2024.

Scope

Voluntary framework, but the de facto standard for US federal procurement, federal-adjacent buyers, and any vendor security questionnaire that mentions AI. Increasingly cited in enterprise contracts.

Penalty exposure

No direct fines. But failure to align is increasingly cited in enterprise contract rejections, board liability disputes, and post-incident litigation. NIST alignment is treated as the duty-of-care baseline.

What triggers it

  • You sell into federal or federal-adjacent buyers.
  • Your enterprise customers require AI RMF alignment in vendor questionnaires.
  • You operate generative AI in production for customer-facing or internal-decision use cases.
  • Your board or auditor asks for an AI governance framework.

Obligations

  • Implement the four functions: Govern, Map, Measure, Manage.
  • Cover 19 categories and approximately 72 subcategories.
  • For generative AI: address the 12 risk categories in AI 600-1 (hallucination, data poisoning, IP infringement, etc.).
  • Establish trustworthy characteristics: valid, reliable, safe, secure, accountable, explainable, privacy-enhanced, fair.

Evidence

  • Per-subcategory audit artifacts.
  • Risk register tied to business impact.
  • TEVV (testing, evaluation, verification, validation) procedures.
  • Incident response playbooks.
  • Documented human oversight gates.

Primary source: NIST AI 100-1 and NIST AI 600-1.

ISO/IEC 42001

ISO/IEC 42001:2023 AI Management System

International, certifiable · global · high

Status

in-force

Effective date

Published December 2023. First certifications issued through 2024 to 2025.

Scope

Certifiable management system standard for organizations that develop, provide, or use AI. Parallel structure to ISO 27001. Increasingly demanded by enterprise procurement.

Penalty exposure

No fines. But absence increasingly blocks enterprise deals, particularly in financial services, healthcare, government, and any sector where the procurement team is mature.

What triggers it

  • Enterprise customers ask for an AI management system certification.
  • You already hold ISO 27001 and need an aligned AI extension.
  • You operate in regulated industries where third-party assurance carries weight.
  • You sell AI products or services and need to differentiate on governance maturity.

Obligations

  • Establish an AI Management System with leadership commitment.
  • AI impact assessments tied to organizational context.
  • Operational controls across the AI lifecycle.
  • Continual improvement loop with internal audits.
  • Third-party certification audit by an accredited body.

Evidence

  • AI management system manual.
  • Statement of Applicability with selected controls.
  • Risk treatment plan and residual risk acceptance.
  • Internal audit reports and management review minutes.
  • Stage 1 and Stage 2 certification audit reports.

Primary source: ISO/IEC 42001:2023.

UK AI Framework

UK Pro-Innovation AI Regulation Framework

United Kingdom · uk · elevated

Status

guidance

Effective date

White Paper March 2023. Government response Feb 2024. AI Safety Institute operational.

Scope

Sectoral, principles-based, regulator-led. Five cross-cutting principles enforced by existing regulators (ICO, FCA, MHRA, CMA, Ofcom).

Penalty exposure

Penalties levied through existing regulators. ICO up to £17.5M or 4% of global turnover. FCA unlimited fines. MHRA criminal penalties for medical devices including AI as SaMD.

What triggers it

  • You operate AI systems in any UK-regulated sector.
  • You process UK personal data with automated decisioning (ICO and UK GDPR Article 22).
  • You deploy frontier or foundation models with material risk.
  • Your regulator has issued AI-specific guidance (FCA, MHRA, etc.).

Obligations

  • Apply the five principles: safety/security/robustness, transparency/explainability, fairness, accountability/governance, contestability/redress.
  • Comply with sector regulator AI guidance.
  • Consider AI Safety Institute model evaluation participation for frontier models.

Evidence

  • Sector-specific compliance documentation.
  • Algorithmic transparency records.
  • Data protection impact assessments where automated decisions affect individuals.
  • Model evaluation reports for frontier systems.

Primary source: DSIT AI White Paper and government response.

Singapore Model AI

Singapore Model AI Governance Framework + AI Verify

Singapore · singapore · moderate

Status

guidance

Effective date

Model Framework v2 in 2020. Generative AI Framework in 2024. AI Verify open-source toolkit operational.

Scope

Voluntary but highly influential in APAC. Adopted as a reference by Hong Kong, Thailand, the Philippines. AI Verify is the world's first AI governance testing framework and toolkit.

Penalty exposure

No direct fines. But MAS (financial sector), PDPC (data protection), and sectoral regulators can act through existing regimes. Penalties up to S$1M under PDPA.

What triggers it

  • You operate AI systems in Singapore or sell to Singaporean enterprises.
  • You operate in APAC and want a recognized governance baseline.
  • Your customers ask for AI Verify test reports.
  • You deploy generative AI and need a model framework with sector annexes.

Obligations

  • Apply the four-area framework: internal governance, decision making, operations management, stakeholder communication.
  • For generative AI: address the nine dimensions in the Generative AI Framework (accountability, data, trusted development, incident reporting, testing, security, content provenance, safety/alignment, AI for public good).
  • Optionally run AI Verify tests for fairness, robustness, explainability.

Evidence

  • Governance structure documentation.
  • Risk assessment and treatment records.
  • AI Verify test reports where applicable.
  • Stakeholder communication plans.

Primary source: IMDA Model AI Governance Framework and Generative AI Framework.

Canada AIDA (died January 2025)

Canada Artificial Intelligence and Data Act (AIDA, Bill C-27, died January 2025)

Canada, federal · canada · elevated

Status

withdrawn

Effective date

Bill C-27 (AIDA) died at prorogation in January 2025. It is not an enacted AI law. OSFI Guideline E-23 on model risk applies separately to federally regulated financial institutions.

Scope

Federal regime focused on high-impact AI systems. OSFI Guideline E-23 (model risk management) already in force for federally regulated financial institutions and applies to AI/ML models.

Penalty exposure

No AIDA penalties apply because Bill C-27 died in January 2025. Separate OSFI supervisory powers remain.

What triggers it

  • You operate AI systems serving Canadian users.
  • You are a federally regulated financial institution (OSFI E-23 applies now).
  • You deploy high-impact AI in employment, services, biometric ID, or critical infrastructure.
  • You handle Canadian personal data with automated decisioning under PIPEDA.

Obligations

  • AIDA died in January 2025 and imposes no duties. Do not treat its proposed obligations as enacted law.
  • For financial institutions: OSFI E-23 model risk governance, model inventory, validation, monitoring.
  • PIPEDA transparency requirements for automated decisions.

Evidence

  • Model inventory with risk tiering.
  • Validation and monitoring reports.
  • Plain-language descriptions of high-impact systems.
  • Privacy impact assessments under PIPEDA.

Primary source: ISED AIDA Companion Document and OSFI Guideline E-23.

Sector overlays

Healthcare & Life Sciences

AI in healthcare is regulated as a medical device, a privacy risk, and a clinical-safety question. All three at once.

Global emphasis

  • eu-ai-act
  • nist-ai-rmf
  • iso-42001

FDA Software as a Medical Device + AI/ML Action Plan

Critical

fda-samd · FDA SaMD · United States, FDA

Applies to

Any AI intended to diagnose, treat, monitor, or inform clinical decisions.

Key obligation

510(k), De Novo, or PMA pathway. Predetermined Change Control Plan for adaptive ML. Real-world performance monitoring.

Evidence

Clinical validation studies, software bill of materials, change control logs, post-market surveillance reports.

HIPAA + OCR AI Guidance

High

hipaa-ai · HIPAA AI · United States, HHS OCR

Applies to

Any AI that processes Protected Health Information for treatment, payment, or operations.

Key obligation

Business Associate Agreements covering AI vendors. Minimum necessary access. Audit logs. Risk analysis covering AI-specific threats including model inversion and re-identification.

Evidence

BAAs with AI vendors, access audit logs, risk analysis documentation, breach response procedures.

EU MDR + IVDR with AI Act overlay

Critical

eu-mdr-ai · EU MDR/IVDR · European Union

Applies to

AI-enabled medical devices and in vitro diagnostics placed on the EU market.

Key obligation

Notified Body conformity assessment. Class IIa or higher for most AI-enabled devices. Dual compliance with AI Act high-risk obligations.

Evidence

Technical file, clinical evaluation report, post-market clinical follow-up, AI Act conformity assessment.

US state AI-in-health laws (CA SB 1120, IL HB 5527, NY)

Elevated

state-ai-health · US state AI health · United States, state-level

Applies to

Health-plan utilization management, prior auth, and clinical decision support in regulated states.

Key obligation

Physician oversight requirements for AI denials. Patient disclosure when AI is used in clinical decisions.

Evidence

Physician review logs, patient disclosure records, AI denial audit trail.

Financial Services & Banking

Model risk is not a new idea in banking. AI is forcing every existing framework to extend.

Global emphasis

  • eu-ai-act
  • nist-ai-rmf
  • iso-42001

Federal Reserve SR 11-7 Model Risk Management

Critical

sr-11-7 · SR 11-7 · United States, Federal Reserve + OCC

Applies to

Any model used in credit decisions, capital calculations, anti-money-laundering, fraud detection, or material business decisions at a regulated bank.

Key obligation

Three pillars: model development standards, validation independent of development, governance and policies. Applies to ML and generative AI as models.

Evidence

Model inventory, validation reports, conceptual soundness documentation, ongoing monitoring outputs.

NYDFS Part 500 + AI Guidance (Oct 2024)

High

nydfs-cyber · NYDFS AI · United States, New York

Applies to

Banks, insurers, and other entities licensed by the NY Department of Financial Services.

Key obligation

Treat AI as both a tool and a threat. Address AI-enabled social engineering, deepfake-based fraud, and model vulnerabilities in the cybersecurity program.

Evidence

Risk assessment covering AI threats, training records, third-party AI vendor due diligence, incident reporting.

CFPB ECOA + Reg B AI Adverse Action Guidance

High

cfpb-credit-ai · CFPB AI Credit · United States, CFPB

Applies to

Any AI or ML model used in consumer credit decisions, pricing, or adverse actions.

Key obligation

Specific, accurate adverse action reasons even for complex models. Cannot use "black box" as a reason.

Evidence

Adverse action reason logic documentation, model explainability reports, fair lending monitoring.

Basel Committee Principles + ECB Guide on AI

Elevated

basel-ai · Basel + ECB AI · Global, prudential

Applies to

Globally systemic banks and ECB-supervised institutions using AI in risk, finance, or treasury.

Key obligation

Operational risk treatment of AI, third-party model risk, board-level oversight expectations.

Evidence

Board AI risk reporting, third-party model assessments, operational risk register entries.

Manufacturing & Industrial

Operational AI on the factory floor is regulated as a safety system, a product, and a workforce decision.

Global emphasis

  • eu-ai-act
  • iso-42001
  • nist-ai-rmf

ISO/IEC 23894 AI Risk Management

High

iso-23894 · ISO/IEC 23894 · Global

Applies to

Industrial AI systems including predictive maintenance, quality vision, autonomous production lines.

Key obligation

Risk-based approach integrated with existing ISO 31000 organization-wide risk management.

Evidence

AI risk register, treatment plans, monitoring records.

EU Machinery Regulation 2023/1230 (AI safety-critical)

Critical

eu-machinery · EU Machinery Reg · European Union

Applies to

Any AI-enabled safety component in machinery placed on the EU market. Applies from January 2027.

Key obligation

Conformity assessment by notified body for safety-critical AI. Documentation of AI behavior under foreseeable misuse.

Evidence

Risk assessment, technical file, EU declaration of conformity, post-market surveillance.

OSHA + state worker safety AI guidance

Elevated

osha-ai · OSHA AI · United States, federal + state

Applies to

AI used in worker monitoring, autonomous mobile robots, robotic process automation in safety-critical paths.

Key obligation

General duty clause applies. Robotic safety standards (ANSI/RIA R15.06 / ISO 10218) extended to AI behaviors.

Evidence

Risk assessments, training records, incident logs.

Supply Chain AI Disclosure Laws (CA AB 1018, NYC LL 144 analogs)

Moderate

supply-chain-aml · Supply chain AI · United States, state-level

Applies to

AI-driven supplier selection, vendor scoring, and procurement decisions in regulated states.

Key obligation

Disclosure of automated decision-making in supplier relationships above certain thresholds.

Evidence

Disclosure notices, model documentation, vendor scoring audit trails.

Retail & E-commerce

Personalization, dynamic pricing, and recommendation engines are now regulated as consumer-protection issues.

Global emphasis

  • eu-ai-act
  • uk-pro-innovation
  • nist-ai-rmf

EU Digital Services Act + DMA recommender transparency

High

eu-dsa · EU DSA · European Union

Applies to

Online platforms with recommender systems, very large online platforms above 45M EU users.

Key obligation

Recommender system transparency, option to opt out of profiling-based recommendations, risk assessments for VLOPs.

Evidence

Algorithmic transparency reports, opt-out mechanisms, risk assessment reports.

FTC AI + Dark Patterns Enforcement

High

ftc-dark-patterns · FTC AI Enforcement · United States, FTC

Applies to

AI used in pricing, advertising, recommendations, or consumer interactions.

Key obligation

Avoid deceptive practices, algorithmic discrimination, and dark patterns. Substantiate AI marketing claims.

Evidence

Marketing claim substantiation, fairness testing records, advertising review logs.

CCPA/CPRA Automated Decision-Making Rules

Elevated

ccpa-cpra-adm · CPRA ADM · United States, California

Applies to

Automated profiling and significant decisions affecting California consumers.

Key obligation

Pre-use notice, opt-out rights, access rights for ADM decisions, risk assessments for high-risk processing.

Evidence

Pre-use notices, opt-out mechanisms, risk assessments, processor agreements.

EU + US dynamic pricing fairness scrutiny

Moderate

pricing-fairness · Dynamic Pricing · EU + US, multiple regulators

Applies to

AI-driven personalized or dynamic pricing.

Key obligation

Document non-discriminatory pricing factors, avoid proxies for protected classes.

Evidence

Pricing logic documentation, fairness testing, internal audit reports.

Transportation & Logistics

Autonomy, route AI, and driver monitoring are regulated as safety, labor, and infrastructure decisions all at once.

Global emphasis

  • eu-ai-act
  • nist-ai-rmf
  • uk-pro-innovation

NHTSA Automated Vehicle Framework + Standing General Order

Critical

nhtsa-av · NHTSA AV · United States, NHTSA

Applies to

Vehicles with SAE Level 2 or higher driving automation, AI-enabled ADAS.

Key obligation

Crash and incident reporting within 24 hours for L2+ systems. Voluntary safety self-assessments. Standing General Order compliance.

Evidence

Crash reports, safety case documentation, simulation testing logs, OTA update controls.

FMCSA AI-Enabled Fleet Safety + Driver Monitoring

High

fmcsa-eldt-ai · FMCSA AI · United States, FMCSA

Applies to

Commercial fleet AI for routing, driver monitoring, hours-of-service, accident prediction.

Key obligation

Hours-of-service accuracy with AI-enabled ELDs. Driver coaching system fairness. Privacy of biometric driver monitoring.

Evidence

ELD audit logs, driver consent records, accident prediction model validation.

FAA + EASA AI in Aviation Safety Roadmap

Critical

iata-faa-ai · Aviation AI · Global, FAA/EASA

Applies to

AI in flight operations, maintenance scheduling, predictive maintenance for aircraft, ATC.

Key obligation

DO-178C and EASA AI Roadmap compliance. Level of AI involvement classification. Explainability for safety-critical decisions.

Evidence

Certification artifacts, safety assessment, AI assurance case.

IMO MSC.428(98) + AI in Maritime

Elevated

imo-cyber · IMO Maritime AI · Global, IMO

Applies to

Maritime AI for routing, port operations, autonomous vessel pilots.

Key obligation

Cyber risk management integrated into Safety Management Systems. AI-specific risk treatment for MASS vessels.

Evidence

Safety Management System documentation, cyber risk register, MASS classification artifacts.

Energy & Utilities

AI on the grid is regulated as critical infrastructure. The threat model includes nation-state actors.

Global emphasis

  • eu-ai-act
  • nist-ai-rmf
  • iso-42001

NERC CIP-015 + AI Operating Procedures

Critical

nerc-cip · NERC CIP · North America, NERC

Applies to

AI in Bulk Electric System operations, grid forecasting, demand response.

Key obligation

Critical infrastructure protection. CIP-015 internal network security monitoring. AI used in operating decisions inherits CIP-005 and CIP-007 obligations.

Evidence

CIP compliance documentation, AI model registry, incident response artifacts.

FERC Order 2222 + RTO AI Market Surveillance

High

ferc-rto-ai · FERC AI · United States, FERC

Applies to

AI in wholesale electricity markets, DER aggregation, congestion management.

Key obligation

Market manipulation rules apply to AI-driven bidding. Transparency for AI used in market participation.

Evidence

Bidding algorithm documentation, market surveillance logs, compliance attestations.

EU CSRD + ISSB + AI in ESG Reporting

Elevated

esg-csrd-ai · CSRD AI · EU + Global

Applies to

AI used in ESG data collection, emissions calculation, climate scenario modeling.

Key obligation

Auditable AI-generated ESG data. Disclosure of AI methodologies under CSRD ESRS.

Evidence

Methodology documentation, audit-ready ESG calculation traces, assurance reports.

NRC AI Strategic Plan + Nuclear AI Guidance

Critical

nrc-ai · NRC AI · United States, NRC

Applies to

AI in nuclear plant operations, predictive maintenance, fuel management.

Key obligation

AI in safety-related systems requires formal qualification. 10 CFR 50 Appendix B quality assurance applies.

Evidence

Qualification documentation, V&V reports, regulatory engagement records.

Technology & Software

Software vendors are the supply chain. Your customers are downloading your AI risk along with your product.

Global emphasis

  • eu-ai-act
  • iso-42001
  • nist-ai-rmf

EU Cyber Resilience Act + AI Act for software

High

eu-cra · EU CRA · European Union

Applies to

Any product with digital elements placed on the EU market. Includes AI-enabled software.

Key obligation

Security by design, vulnerability handling for the product lifetime or 5 years, CE marking, SBOM disclosure.

Evidence

Technical documentation, SBOM, vulnerability disclosure procedures, conformity assessment.

AICPA SOC 2 + AI Trust Services Criteria

High

soc2-ai · SOC 2 AI · United States, AICPA

Applies to

SaaS vendors with AI features being evaluated by enterprise procurement.

Key obligation

Extend Trust Services Criteria to cover AI-specific controls. Increasingly demanded in vendor security questionnaires.

Evidence

SOC 2 Type II report with AI control narrative, AI governance policy, control test results.

US State AI Laws (CO SB 26-189, CA SB 1000, TX TRAIGA)

High

us-state-ai · US State AI · United States, state-level

Applies to

Software using AI in consequential decisions for residents of regulated states.

Key obligation

Colorado SB 26-189 starts Jan 1, 2027: notice, adverse-outcome explanation within 30 days, human review on request and 3-year records. Impact assessments, risk programs and duty of care were removed. Enforcement is AG-only, with a 60-day cure until Jan 1, 2030. Texas TRAIGA applies from Jan 1, 2026. California SB 1000 applies from Sep 30, 2026.

Evidence

Consumer notices, adverse-outcome explanations, human review records and 3-year records for Colorado.

Open Source AI Licensing + EU AI Act FOSS Carve-Outs

Moderate

open-source-ai · Open Source AI · Global

Applies to

Companies distributing or using open-source AI models in commercial products.

Key obligation

OSAID compliance, model card publication, dataset documentation, EU AI Act FOSS exemption boundaries.

Evidence

Model cards, dataset documentation, license compliance review.

Agriculture & AgTech

Precision agronomy and autonomous equipment AI is regulated where it intersects with safety, environment, and farm data.

Global emphasis

  • eu-ai-act
  • iso-42001
  • uk-pro-innovation

EPA Pesticide Application AI Guidance

High

epa-pesticide-ai · EPA AI · United States, EPA

Applies to

AI-driven variable-rate pesticide and fertilizer application.

Key obligation

Label compliance enforced for AI applicators. Drift modeling and buffer-zone accuracy.

Evidence

Application logs, calibration records, label compliance attestations.

USDA Farm Data Privacy + Ag Data Transparent

Elevated

usda-data-rights · USDA Data · United States, USDA

Applies to

AgTech platforms processing farm operational and yield data.

Key obligation

Voluntary Ag Data Transparent certification. Data ownership clarity, consent for secondary use.

Evidence

Data rights agreements, certification documentation, consent records.

ISO 18497 Agricultural Machinery Autonomy Safety

High

iso-18497 · ISO 18497 · Global

Applies to

Autonomous and highly automated agricultural equipment.

Key obligation

Safety architecture for autonomous ag machinery. Risk assessment for AI-enabled motion control.

Evidence

Safety case, hazard analysis, operator manuals.

EU CAP + Sustainable Use Directive AI Reporting

Moderate

eu-cap-ai · EU CAP AI · European Union

Applies to

Farm management AI used to substantiate CAP subsidy claims or pesticide reduction targets.

Key obligation

Auditable AI methodology for subsidy substantiation. SUD pesticide reduction reporting.

Evidence

Methodology documentation, audit-ready calculation traces, subsidy claim support.

Education & Media

AI here lives at the intersection of child safety, copyright, and academic integrity. Each regulator has a different priority.

Global emphasis

  • eu-ai-act
  • uk-pro-innovation
  • nist-ai-rmf

FERPA + COPPA + State Student Data Privacy Laws

High

ferpa-coppa-ai · FERPA/COPPA · United States, federal + state

Applies to

EdTech platforms using AI to process student records or interact with minors.

Key obligation

FERPA school official exception requirements. COPPA verifiable parental consent for under-13. State-level student data privacy laws (CA SOPIPA, others).

Evidence

School consent records, parental consent flows, data deletion procedures, vendor agreements.

EU AI Act High-Risk Education Annex III

Critical

ai-act-edu · EU AI Edu · European Union

Applies to

AI for admission, evaluation, monitoring, or determining access to education.

Key obligation

High-risk classification under Annex III. Full conformity assessment, registration, human oversight.

Evidence

Conformity assessment, EU AI Database registration, human oversight documentation.

US + EU + UK AI Copyright Rules

High

copyright-ai · AI Copyright · Global

Applies to

Media organizations using generative AI for content creation, news platforms.

Key obligation

Training data licensing. Content provenance and watermarking (C2PA). Disclosure of AI-generated content under EU AI Act Article 50.

Evidence

Training data provenance, content provenance records, AI disclosure metadata.

Higher-Ed AI Academic Integrity Policies

Moderate

academic-integrity · Academic Integrity · Institutional

Applies to

Institutional AI use in admissions, grading, plagiarism detection.

Key obligation

Fair-use policies, false-positive controls for AI detection, due process for AI-flagged work.

Evidence

Policy documentation, false-positive rate audits, appeal records.

Enforcement dates

  1. EU prohibited practices apply.

  2. EU general-purpose AI obligations apply.

  3. Texas TRAIGA (HB 149) takes effect.

  4. EU Article 50 transparency applies.

  5. California SB 1000 AI Transparency Act amendments apply. The 1 million user threshold is removed.

  6. Article 50(2) marking applies to systems on the market before Aug 2, 2026. Two new Article 5 bans cover non-consensual intimate imagery and CSAM generation.

  7. Colorado SB 26-189 duties begin. California AB 1609 bars businesses over $500M revenue from presenting a customer service chatbot as human.

  8. EU Machinery Regulation 2023/1230 applies.

  9. California SB 947 prohibits sole reliance on automated decisions to discipline or fire workers.

  10. EU Annex III high-risk obligations apply.

  11. EU Annex I high-risk obligations apply.

Audit evidence

01

Show me your AI inventory.

Every model, agent, and AI-enabled feature in production. If the answer takes more than two days, you have already failed step one.

Evidence

Model registry, intended-use statements, business owner per system.

02

Show me your risk classification per system.

Which systems are high-risk under EU Annex III. Which trigger sector overlays. Which use generative AI requiring AI 600-1 treatment.

Evidence

Risk classification documentation, conformity assessment status, GenAI risk profile.

03

Show me the evidence for one system end-to-end.

TEVV results, data lineage, human oversight logs, incident reporting trail, change control. The audit is the artifacts, not the policy deck.

Evidence

Per-system audit package: design records, validation, monitoring, incidents.

An AI agent adds a row to a long audit ledger while a person reviews it.

The AI Regulations Playbook

Inside the brief

A 4-page board-ready brief. The six global regimes, the timeline, the audit-trigger questions, and a one-page checklist of the evidence your team needs on file. Built for CEO and CFO use, not for a compliance binder.

Download the playbook

Next steps

AI governance Governance Sprint EU AI Act playbook NIST AI RMF guide

Last reviewed: October 13, 2026

Regulatory diagnostic

Map your exposure before someone else does.

A Sophizo Regulatory Diagnostic produces your AI inventory, risk classification per system, gap analysis against the regimes that apply, and a 90-day remediation plan. Board-ready. Auditor-defensible.

Schedule Free Call
More

Related resources

Keep exploring the frameworks and engagements connected to this topic.

EU AI Act Classification Checklist

Classify your B2B SaaS system correctly.

NIST AI RMF for Small Business

The risk framework scaled to lean teams.

RevOps AI Risk Register Template

A working register you can adopt today.

AI Governance Benchmark 2026

Where board-grade programs stand this year.

Healthcare AI Governance and Liability

Clinical and commercial risk in regulated AI.

Governance Accelerator

Compressed board-grade governance buildout.

Related reading