2.3AI Compliance, Legal Frameworks, and Regulatory Requirements
AI law is a patchwork: the EU AI Act is binding and risk-based, other countries range from innovation-first laws to sector rules, and voluntary standards help prove good practice. Governance teams map each obligation to an owner, a control and evidence, and manage the legal risk that remains.
There is no single world AI law. The EU has a binding, risk-based act; the United States relies on executive policy, sector regulators and state laws; and Asian countries mix framework laws with targeted rules. Voluntary standards sit underneath all of them as the shared way to show good practice.
diagram
AI rules differ by region: binding and risk-based in the EU, policy and state-led in the US, and service-specific or framework laws in Asia. Voluntary standards are the common layer underneath.
Key points
Standards such as ISO/IEC 42001 and the NIST AI Risk Management Framework (AI RMF) are voluntary; regulations such as the EU AI Act (Regulation (EU) 2024/1689) are binding and carry fines.
US: no comprehensive federal AI statute; Executive Order (EO) 14110 was revoked on 20 January 2025, EO 14179 led to the July 2025 AI Action Plan, and in March 2026 the White House urged Congress to preempt state laws.
US states still act: Colorado repealed and re-enacted its 2024 AI Act as an automated decision-making technology law effective 1 January 2027, and New York City requires bias audits of hiring tools.
China regulates by service type, for example the Interim Measures for Generative AI Services (effective 15 August 2023) and AI-generated content labeling measures (effective 1 September 2025).
South Korea's AI Basic Act took effect 22 January 2026 with duties for high-impact AI; Japan's AI Promotion Act (May 2025) is innovation-first, led by a Prime Minister-chaired AI Strategic Headquarters.
The UK has no AI-specific law and regulates AI through existing sector rules; Canada's proposed Artificial Intelligence and Data Act (AIDA) died when Parliament was prorogued in January 2025.
The Council of Europe Framework Convention on AI (CETS 225), opened for signature 5 September 2024, is the first binding international AI treaty; it needs five ratifications and is not yet in force.
Exam tip
First separate voluntary standards from binding law; many distractors call ISO/IEC 42001 or the NIST AI RMF mandatory. Older material that cites EO 14110 as current US policy is out of date.
The EU AI Act sorts AI by how much harm it could do, like a traffic light. A short list of uses is banned, high-risk uses must pass strict checks before reaching the market, some systems only need to tell people they are AI, and most AI faces no new rules. General-purpose AI models have their own separate track.
diagram
Classification starts with the banned list, then the Annex I and Annex III high-risk tests, then the Article 50 transparency triggers. Anything left is minimal risk with no new duties.
Key points
Regulation (EU) 2024/1689, the EU AI Act, uses four risk levels: unacceptable (prohibited), high risk, transparency (limited) risk, and minimal or no risk.
Article 5 bans practices such as harmful manipulation, social scoring, untargeted facial-image scraping and workplace emotion recognition; a ban on AI nudification and child abuse material applies from 2 December 2026.
High risk covers AI that is, or is a safety component of, a product under Annex I law needing third-party assessment (Article 6(1)), plus the use cases in Annex III (Article 6(2)).
Annex III areas: biometrics, critical infrastructure, education, employment, essential private and public services, law enforcement, migration and border control, and justice and democratic processes.
An Annex III system is not high-risk if it poses no significant risk, such as a narrow procedural task, but one that profiles natural persons is always high-risk (Article 6(3)).
Transparency risk (Article 50) covers telling people they are talking to AI, machine-readable marking of synthetic content, deepfake disclosure and notices for emotion recognition.
Fines reach EUR 35 million or 7% of worldwide annual turnover for prohibited practices, EUR 15 million or 3% for most other breaches, and EUR 7.5 million or 1% for misleading information.
Exam tip
Classify by intended use, not technology: the same model can be minimal risk in a game and high risk in hiring. Profiling of natural persons in an Annex III area is always high risk.
The AI Act switches on in stages rather than all at once. In 2026 the EU amended it through the AI Omnibus, which moved the high-risk deadlines later and added a new ban. Study material written before mid-2026 still shows 2 August 2026 for high-risk rules, which is no longer correct.
diagram
The AI Act applies in stages from 2024 to 2030. The AI Omnibus moved the high-risk dates to 2 December 2027 and 2 August 2028 and added a new ban from 2 December 2026.
Key points
The AI Act entered into force on 1 August 2024; definitions, AI literacy and the prohibitions have applied since 2 February 2025.
General-purpose AI (GPAI) model obligations, EU governance bodies and national penalty rules applied from 2 August 2025; GPAI models already on the market have until 2 August 2027.
From 2 August 2026 most remaining rules apply, including Article 50 transparency, and enforcement started for GPAI models, prohibitions, transparency and AI literacy.
Regulation (EU) 2026/1744, the AI Omnibus, was adopted 8 July 2026, published 24 July 2026 and in force from 27 July 2026; it defers the high-risk rules and simplifies some duties.
High-risk rules now apply from 2 December 2027 for Annex III use cases and from 2 August 2028 for AI in Annex I regulated products such as machinery, toys and lifts.
From 2 December 2026 the new nudification and child abuse material ban applies, and generative systems placed on the market before 2 August 2026 must meet Article 50(2) marking.
High-risk systems already on the market before their rules apply are covered only after a significant design change, but those for public authorities must comply by 2 August 2030 (Article 111).
Exam tip
Watch for outdated dates: high-risk obligations no longer start on 2 August 2026. The prohibitions and AI literacy (February 2025) and GPAI rules (August 2025) were not delayed.
A general-purpose AI model is a foundation model that can do many different tasks and gets built into many products. The AI Act puts duties on the company that makes the model, so the businesses building on it get what they need to comply. The largest models, presumed to pose systemic risk, carry extra safety duties.
All GPAI model providers
Plus systemic-risk models
Duties
Article 53
Technical documentation
Information for integrators
Copyright policy and training summary
Article 55
Adversarial model evaluation
Systemic risk mitigation
Incident reporting and cybersecurity
Trigger and enforcement
Placing a GPAI model on the EU market
AI Office supervises
Over 10^25 FLOP of training compute
Or a Commission designation
Every GPAI model provider has baseline transparency and copyright duties. Models presumed to carry systemic risk add evaluation, mitigation, incident reporting and cybersecurity duties.
Key points
All general-purpose AI (GPAI) model providers keep technical documentation, give integrators capability and limitation information, adopt a copyright policy and publish a training-content summary (Article 53).
The copyright policy must respect text-and-data-mining opt-outs reserved under Article 4(3) of Directive (EU) 2019/790, and the training summary uses the AI Office template.
A GPAI model is presumed to have high-impact capabilities, and so systemic risk, when its training used more than 10^25 floating-point operations (FLOP) (Article 51).
Systemic-risk providers must also run adversarial model evaluations, assess and mitigate systemic risks, report serious incidents to the AI Office and ensure cybersecurity (Article 55).
Open-source models with public weights skip the documentation duties in Article 53(1)(a) and (b), but not the copyright policy or summary, and never if the model has systemic risk.
The GPAI Code of Practice (July 2025) covers transparency, copyright, and safety and security; providers may rely on it to show compliance until harmonised standards exist.
The AI Office enforces GPAI rules, and from 2 August 2026 the Commission can fine providers up to 3% of worldwide turnover or EUR 15 million (Article 101).
Exam tip
Model duties sit with the GPAI model provider; a company building an app on the model has its own provider or deployer duties for that AI system. Remember 10^25 FLOP as the systemic-risk presumption.
The AI Act assigns duties by role, not by company size. Whoever builds an AI system and puts its name on it is the provider, whoever uses it at work is the deployer, and others move it through the supply chain. Roles can change hands: rebrand or substantially change a high-risk system and you inherit the provider's duties.
diagram
An AI system moves from provider through importer and distributor to the deployer, and its outputs affect people. A party that rebrands or substantially modifies a high-risk system takes over the provider's duties.
Key points
A provider develops an AI system or general-purpose AI model, or has one developed, and places it on the market or into service under its own name or trademark, paid or free (Article 3(3)).
A deployer uses an AI system under its authority, except in personal non-professional activity (Article 3(4)); operator is the umbrella term for all roles (Article 3(8)).
An importer places a non-EU provider's system on the EU market, a distributor makes it available further down the chain, and an authorised representative acts in the EU for a non-EU provider.
The Act reaches beyond the EU: it covers non-EU providers placing systems on the EU market and non-EU providers and deployers whose system output is used in the EU (Article 2).
A distributor, importer or deployer becomes the provider if it rebrands a high-risk system, substantially modifies it, or changes a system's purpose so it becomes high-risk (Article 25).
High-risk providers and suppliers of tools, components or models must agree in writing the information and access the provider needs to comply (Article 25(4)).
ADG's (Adopt, Defend, Govern) shared responsibility model: control ownership shifts toward the vendor for software as a service (SaaS) AI, but accountability for use never fully transfers (Minimum Control MC-12).
Exam tip
Ask who places the system on the market under their name (provider) and who uses it in their own operations (deployer). A deployer that rebrands or substantially modifies a high-risk system can become its provider.
When AI harms someone, two questions follow: who pays, and what can the affected person demand? In the EU the planned AI-specific liability law was dropped, so injured people rely on new product liability rules that treat software and AI as products. Data protection law and the AI Act add rights to complain and to get an explanation.
Product Liability Directive
Software and AI are products
No-fault liability for defects
Defect presumed if evidence withheld
Shared effect
Protect people harmed by AI
Logs and documentation become evidence
AI Act and GDPR rights
Complaint to authority, Article 85
Explanation of decision, Article 86
Limits on solely automated decisions
Product liability law decides who pays for harm from defective AI, while the AI Act and GDPR give affected people rights. Both reward good records, because evidence decides disputes.
Key points
The new Product Liability Directive (EU) 2024/2853 defines software, including AI systems, as a product, so manufacturers face no-fault liability for damage caused by defective AI.
It replaces Directive 85/374/EEC for products placed on the market from 9 December 2026, which is also the deadline for Member States to transpose it.
A court can presume a product defective, for example when the defendant fails to disclose relevant evidence, which eases the claimant's burden of proof (Article 10).
The proposed AI Liability Directive was withdrawn: the Commission announced it in its 2025 work programme, and the withdrawal notice was published in October 2025.
General Data Protection Regulation (GDPR) Article 22 gives a right not to be subject to a decision based solely on automated processing, including profiling, with legal or similarly significant effects.
Under the AI Act anyone can complain to a market surveillance authority (Article 85), and people hit by an adverse Annex III high-risk decision can get an explanation from the deployer (Article 86).
Deployers must tell people when an Annex III high-risk system makes or assists decisions about them (Article 26(11)) and inform workers before workplace use (Article 26(7)).
Exam tip
When asked who is liable for a defective AI product in the EU, think the Product Liability Directive, not the withdrawn AI Liability Directive. The right to an explanation of a high-risk decision is AI Act Article 86.
For a high-risk AI system, the provider does the heavy lifting before launch: risk management, data quality, documentation, testing and a quality system, then a conformity check and a CE mark. The deployer must use it as instructed, keep people in control, watch it and keep the logs. Some deployers, such as public bodies, must also assess the impact on fundamental rights first. All of these duties, including serious-incident reporting, start on the high-risk dates: 2 December 2027 for Annex III and 2 August 2028 for Annex I.
Provider
Deployer
Before market or first use
Build and certify
Articles 9 to 15 requirements
QMS and conformity assessment
CE marking and registration
Prepare to use
Follow instructions for use
Assign competent human oversight
FRIA if public body, credit or insurance
In operation
Watch and report
Post-market monitoring, Article 72
Serious incidents within 15 days
Watch and keep records
Monitor and inform the provider
Keep logs at least six months
Providers carry the build-time and market-entry duties, deployers carry the use-time duties. Both keep watching the system once it is running.
Key points
Providers meet Articles 9 to 15: a risk management system, data governance, technical documentation, automatic logging, transparency to deployers, human oversight, and accuracy, robustness and cybersecurity.
Providers also run a quality management system (Article 17), complete conformity assessment (Article 43), sign an EU declaration of conformity, affix CE marking and register most Annex III systems (Article 49).
Most Annex III systems use internal control (Annex VI) with no notified body; biometric systems need a notified body (Annex VII) when harmonised standards are not fully applied.
Providers report serious incidents within 15 days of awareness, 10 days if a person died, and 2 days for a widespread infringement or serious critical-infrastructure disruption (Article 73).
Deployers use the system per its instructions, assign competent overseers, keep input data relevant, monitor operation and keep logs for at least six months (Article 26).
Public bodies, private providers of public services, and deployers of credit scoring or life and health insurance pricing must do a fundamental rights impact assessment (FRIA) before first use (Article 27).
A FRIA can build on a data protection impact assessment (DPIA), and the AI Omnibus lets deployers cross-reference the relevant DPIA sections instead of repeating them.
Exam tip
Provider means build-time duties (documentation, conformity, CE marking, post-market monitoring); deployer means use-time duties (oversight, monitoring, logs, FRIA). Incident deadlines are 15, 10 and 2 days.
Sector rules add their own layer on top of general AI law. Banks, insurers, medical device makers and employers each face regulators who already had rules for models, devices or hiring, and now apply them to AI. The governance job is to stack these requirements into one program rather than run separate ones.
diagram
Each sector adds its own AI rules on top of the AI Act. Finance, health, employment and the public sector are the areas most often tested.
Key points
Finance: the EU AI Act lists creditworthiness assessment and credit scoring (except fraud detection) and life and health insurance risk pricing as Annex III high-risk uses.
EU financial institutions meet the deployer monitoring duty, and keep AI logs, through their existing internal governance rules under financial services law (Article 26(5) and (6)).
On 17 April 2026, US bank regulators replaced SR 11-7 model risk guidance with SR 26-2; it covers traditional and non-generative AI models but excludes generative and agentic AI.
Health: AI in medical devices that need third-party conformity assessment is high-risk through Annex I product law, with AI Act rules applying from 2 August 2028.
US Food and Drug Administration (FDA) final guidance (December 2024) on predetermined change control plans (PCCPs) lets planned AI device modifications proceed without a new marketing submission for each.
Employment: AI for recruitment, promotion, termination and worker monitoring is Annex III high-risk, and New York City (NYC) Local Law 144 requires a bias audit within one year before using a hiring tool.
NYC employers must publish a summary of the bias audit and notify candidates or employees at least 10 business days before using an automated employment decision tool (AEDT).
Exam tip
Sector rules add to the AI Act; they do not replace it. Material that cites SR 11-7 as current US model risk guidance has been out of date since April 2026.
A compliance program turns a pile of laws and standards into a living list of obligations, each with an owner, a control and proof. Because one control often satisfies several laws, a crosswalk saves duplicate work. Regular audits and reviews show regulators the program is real, not paperwork.
diagram
Laws and standards become an obligations register, each obligation maps to a control, and each control leaves evidence. Audits and governance reviews find gaps and feed them back into the register.
Key points
NIST AI Risk Management Framework (AI RMF) GOVERN 1.1 requires AI legal and regulatory requirements to be understood, managed and documented: the basis of an obligations register.
ADG's (Adopt, Defend, Govern) crosswalk maps each Minimum Control to the EU AI Act, NIST AI RMF and ISO/IEC 42001, for example MC-8 runtime monitoring to Article 72, MANAGE and Clause 9.1.
Other ADG mappings: MC-2 risk classification to Articles 6 and 7, MAP and 6.1.2; MC-9 incident response to Article 73 and 10.2; MC-1 inventory to Articles 49 and 71 and 7.5.
ADG calls its mapping indicative, not exhaustive: it supports compliance but does not guarantee it, so each organization still runs its own legal assessment.
Harmonised standards cited in the Official Journal give a presumption of conformity (Article 40); EN 18286:2026 for the Article 17 quality management system was the first, in October 2026.
ISO/IEC 42001 internal audit (9.2) and management review (9.3), plus ADG MC-10 governance reviews, produce recurring evidence that compliance controls operate.
ADG tracks compliance through AI-related audit findings (Tier 2) and AI compliance coverage, the share of systems with a current governance review (Tier 3).
Exam tip
The efficient answer maps one control to many obligations and keeps evidence per control. Voluntary standards support compliance; only harmonised standards cited in the Official Journal give a legal presumption of conformity.
Obligations register entry mapped to one control (illustrative) · json
{
"obligationId": "EU-AIA-ART72",
"source": "Regulation (EU) 2024/1689, Article 72",
"requirement": "Post-market monitoring system and plan",
"appliesTo": ["contoso-claims-triage"],
"control": "ADG MC-8 Runtime Monitoring",
"alsoSatisfies": ["NIST AI RMF MANAGE", "ISO/IEC 42001 9.1"],
"owner": "AI service owner",
"evidence": "Monitoring dashboard export and alert response report",
"nextReview": "2027-01-15"
}
Even a compliant AI system carries legal risk: it may use copyrighted training data, mishandle personal data, discriminate or break a contract promise. Legal risk management finds those exposures early and closes them with contracts, assessments and records. The goal is to be able to show, later, that reasonable care was taken.
diagram
Legal risk spreads across intellectual property, privacy, contracts, discrimination and product liability. Each branch is closed with a document or record that can be shown later.
Key points
Intellectual property: general-purpose AI (GPAI) providers need a copyright policy honoring text-and-data-mining opt-outs, and NIST AI Risk Management Framework GOVERN 6.1 covers third-party infringement risk.
Privacy: deployers use the provider's information to complete a General Data Protection Regulation (GDPR) Article 35 data protection impact assessment (DPIA) where required (AI Act Article 26(9)).
Automated decisions: GDPR Article 22 restricts solely automated decisions with legal or similarly significant effects, which is why human involvement in those decisions matters legally.
Contracts: ADG (Adopt, Defend, Govern) vendor due diligence calls for clauses on incident notification, data handling, model change management and liability allocation, plus rollback and exit plans.
Bias testing: new AI Act Article 4a, replacing the deleted Article 10(5), lets high-risk providers process special-category data only where strictly necessary, with safeguards and deletion after use.
Discrimination: bias in hiring, credit or insurance AI creates legal exposure, so ADG Minimum Control MC-11 fairness evaluation reports are core defensive evidence.
Liability: under the new Product Liability Directive, failing to disclose relevant evidence lets a court presume a product defective, so retained logs and documentation matter.
Exam tip
Legal risk answers favor prevention plus evidence: contract clauses, impact assessments and retained records. Blaming the vendor is a distractor; accountability for use stays with the deploying organization.