AI Compliance: Requirements, Risks & How to Build a Compliance Program

AI compliance is the process of identifying the legal, regulatory, contractual, privacy, security, governance, and internal-control requirements that apply to an organization’s AI systems, then implementing and maintaining evidence that those requirements are being addressed.

In practice, an effective AI compliance program usually combines an AI inventory, applicability assessment, risk classification, governance responsibilities, privacy and security controls, testing, documentation, human oversight, supplier management, incident response, and continuous monitoring.

Compliance is not determined by one AI law or framework. The requirements for a customer-service chatbot can differ significantly from those affecting an AI recruitment tool, credit-decision system, healthcare application, fraud-detection system, or general-purpose AI model. Jurisdiction, intended purpose, organizational role, data, affected individuals, industry, and deployment context all matter.

Organizations therefore need a structured process for determining what applies, translating those requirements into controls, and retaining evidence that the controls work. This guide explains the major AI compliance requirements and risks and provides a practical eight-step approach for building a compliance program.

This article provides general information, not legal advice. Organization-specific obligations should be assessed against the relevant legislation, jurisdiction, system, sector, and facts.

What Is AI Compliance?

AI compliance means identifying the requirements that apply to an AI system and ensuring that the organization has appropriate governance, controls, documentation, monitoring, and accountability to address them.

It is closely connected to AI governance, AI risk management, privacy, cybersecurity, and responsible AI, but these concepts are not interchangeable.

AI governance establishes who has authority, responsibility, and oversight. AI risk management identifies, evaluates, prioritizes, and treats risks. Privacy compliance addresses legal obligations where personal data is involved. Cybersecurity focuses on protecting systems, data, infrastructure, and users. AI ethics can inform broader organizational principles concerning issues such as fairness and responsible use.

AI compliance connects these activities to actual obligations. A company may have a strong responsible-AI policy while still missing a regulatory requirement. Likewise, adopting a recognized risk framework or management standard does not automatically establish legal compliance.

Compliance should also be treated as a lifecycle activity. An AI system can change after approval because of new models, configurations, prompts, datasets, integrations, vendors, users, deployment locations, or business purposes. Regulatory requirements and official guidance can also change.

Why AI Compliance Matters for Organizations

AI systems can affect privacy, security, safety, employment, consumer interests, access to services, fundamental rights, and important organizational decisions. The significance of those effects depends heavily on the use case.

A generative AI assistant used to improve internal drafting, for example, creates a different risk profile from an AI tool used to rank job applicants or support lending decisions.

A mature compliance program helps an organization determine which AI systems it actually uses, which requirements apply to each system, who owns the related risks and controls, what approvals are necessary, what evidence must be retained, and when a system must be reviewed again.

This requires more than publishing an AI policy. Compliance needs accountable owners, operational controls, documented decisions, appropriate technical and organizational assessments, monitoring, and escalation.

What AI Compliance Requirements Do Organizations Need to Consider?

The first step is not selecting a framework. It is determining what actually applies.

An applicability assessment should consider the AI system’s intended purpose, deployment location, organizational role, affected individuals, data, sector, level of decision-making influence, third-party dependencies, and relevant jurisdictions.

A practical assessment can begin with the following questions:

This is not a universal legal test. It is a practical starting point for determining which specialist legal or compliance assessments may be necessary.

Identify the Laws and Regulations That Apply

AI-specific legislation is only one part of the picture.

Depending on the use case and jurisdiction, organizations may also need to consider data protection and privacy law, consumer protection, employment and anti-discrimination requirements, product regulation, cybersecurity rules, sector-specific obligations, intellectual property law, contracts, and procurement commitments.

The EU AI Act is an important example. The current consolidated text of Regulation (EU) 2024/1689 confirms that the Act entered into force in 2024 and follows a staged application timetable, with significant provisions applying on different dates rather than through one universal deadline.

Organizations should therefore map AI laws and regulatory requirements at the system level instead of assuming that every AI use case falls under the same obligations.

Understand AI Regulations Across Different Countries

AI regulatory approaches vary significantly between jurisdictions.

In the European Union, the AI Act establishes horizontal AI-specific requirements alongside existing legal regimes such as data protection, consumer, employment, cybersecurity, and sector-specific regulation. The legislation distinguishes between different AI categories and actors, meaning the obligations applicable to an organization depend on the specific system and role. The consolidated EU AI Act on EUR-Lex should be used when checking the current legal text.

The United Kingdom has continued to use a regulator-led, principles-based model rather than treating AI regulation as a single standalone regime covering every sector. The UK government’s published strategic approaches to AI regulation describe how existing regulators apply AI-related principles and address risks within their respective areas of responsibility.

In the United States, compliance analysis may involve federal consumer-protection and sector-specific requirements, regulator enforcement, contractual obligations, and state laws. In 2026, for example, the Federal Trade Commission proposed guidance concerning deceptive practices in the marketing of AI systems under Section 5 of the FTC Act, illustrating how existing legal authorities can be applied to AI-related conduct.

Organizations operating internationally therefore need a structured process for monitoring AI regulations across different countries rather than assuming that one jurisdiction’s assessment can be reused without modification.

EU AI Act: What Applies as of 28 September 2026?

The EU timetable deserves particular attention because older compliance guides may contain dates that no longer reflect the amended legislation.

The European Commission’s current AI Act enforcement timeline confirms that Annex III high-risk rules apply from 2 December 2027 and high-risk systems embedded in regulated products under Annex I follow from 2 August 2028.

For general-purpose AI, the Commission’s official GPAI obligations guidance states that provider obligations began applying on 2 August 2025, while the Commission’s enforcement powers apply from August 2026.

For transparency, the Commission’s Article 50 transparency guidelines confirm that the relevant transparency obligations began applying on 2 August 2026.

This timetable should not be treated as a substitute for an Article-by-Article applicability assessment.

Understand the Difference Between Laws, Standards and Frameworks

One of the most important AI compliance distinctions is the difference between binding legal obligations and voluntary or organizational governance tools.

The NIST AI Risk Management Framework is intended for voluntary use and supports organizations in managing AI risks.

By contrast, ISO/IEC 42001:2023 is an international management-system standard specifying requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System. Neither NIST AI RMF nor ISO/IEC 42001 is legislation.

Core AI Compliance Requirements

AI Governance and Accountability

AI governance should define who can approve an AI system, who owns its risks, who maintains it, who monitors compliance, and who has authority to intervene.

Responsibilities should cover decision-making, escalation, exceptions, incident management, vendor oversight, and periodic review. The governance model should also identify when specialist involvement from legal, privacy, cybersecurity, compliance, risk, HR, procurement, or technical teams is required.

The aim is traceable accountability, not merely a committee or policy that exists on paper.

AI Risk Assessment and Classification

Organizations should maintain an AI inventory and assess each material system according to its actual context.

The assessment may consider intended purpose, affected stakeholders, possible impacts, data, autonomy, human involvement, security risks, supplier dependencies, regulatory classification, and organizational risk appetite.

Internal risk categories should not be presented as though they are universal legal classifications. Legal classifications must come from the applicable law.

A system should also be reassessed when its use changes. A general productivity tool, for example, may require a different review if it is later integrated into a consequential employment or customer-decision process.

Data Privacy and AI Compliance

Not every AI system processes personal data. Where personal data is involved, organizations should identify the privacy requirements relevant to that processing.

Potential considerations include lawful processing, purpose limitation, data minimization, accuracy, security, transparency, individual rights, retention, profiling, and automated decision-making where applicable.

The UK Information Commissioner’s Office provides dedicated AI and data-protection guidance explaining how UK GDPR principles apply to AI and also provides tools for assessing risks to individual rights and freedoms.

The ICO guidance emphasizes a risk-based approach, including assessing risks to individuals and applying proportionate technical and organizational measures. It also distinguishes between legal requirements and broader good practice.

Transparency and Explainability

Transparency can include informing people that AI is being used, explaining the system’s purpose, describing relevant limitations, communicating how outputs should be interpreted, and providing required disclosures.

Legal transparency requirements must be distinguished from broader explainability practices.

Under Article 50 of the EU AI Act, defined categories of AI systems are subject to specific transparency requirements. The European Commission’s official transparency guidance for AI systems covers requirements relating to areas such as direct AI interaction and specified forms of AI-generated or manipulated content. These obligations apply from 2 August 2026.

Organizations should assess the precise provision rather than assuming that every AI application carries the same disclosure obligation.

Human Oversight and Accountability

Human oversight should be designed around the significance of the use case.

Where oversight is legally required or adopted as a risk control, the responsible person should have appropriate competence, access to relevant information, authority to challenge the AI output, and the ability to intervene or escalate.

Simply placing a human at the end of an automated process does not automatically make the oversight meaningful.

Organizations should document what the reviewer is expected to check, what limitations they need to understand, when they must intervene, and how disagreements or exceptions are recorded.

Documentation, Records and Evidence

Documentation turns compliance decisions into evidence.

Depending on the system and applicable requirements, useful records may include:

• AI inventory entries.

• Intended-purpose statements.

• Applicability assessments.

• Risk assessments.

• Privacy reviews.

• Vendor due diligence.

• Approval records.

• Testing results.

• System and model documentation.

• Human-oversight procedures.

• Incident records.

• Change logs.

• Training records.

• Monitoring results.

A practical control-to-evidence map can make this easier to manage:

The exact records will depend on the organization and legal context. The objective is to create a traceable link between the requirement, the control used to address it, the responsible owner, and the evidence showing that the control operates.

AI Testing, Monitoring and Incident Management

Pre-deployment testing should be proportionate to the system’s purpose and risks.

Depending on the use case, testing may include performance, reliability, security, robustness, foreseeable misuse, data-quality checks, and fairness or bias assessment where relevant.

The NIST AI RMF Core specifically treats measurement, testing, monitoring, and documentation as parts of structured AI risk management and emphasizes that risk management should continue throughout the AI lifecycle.

Post-deployment monitoring should identify changes in system behavior, model performance, security, data, user groups, vendors, integrations, and business purpose.

Incident processes should establish who investigates, who must be informed, when use should be restricted or suspended, how corrective actions are tracked, and whether the incident triggers reassessment.

What Are the Main AI Compliance Risks?

Regulatory and Legal Risk

A common compliance failure is not deliberate non-compliance but incorrect applicability analysis.

An organization may overlook a jurisdiction, misidentify its role, apply the wrong classification, fail to retain evidence, or continue relying on an assessment that no longer reflects the current system.

Regulatory change adds another layer of risk. Compliance monitoring should therefore track both external regulatory changes and internal changes to the system.

AI Liability Risks

AI can distribute responsibility across developers, vendors, integrators, deployers, professional users, and other parties.

Relevant AI liability risks can include responsibility associated with AI-supported decisions, contractual allocation of risk, third-party failures, product or service obligations, and harm connected to the organization’s use of the system.

Specific liability should never be assumed automatically. It depends on the jurisdiction, facts, contractual relationships, applicable law, and role of each party.

Strong documentation is important because it can show how the system was assessed, approved, tested, monitored, and governed.

Privacy and Data Protection Risk

Privacy problems can arise from excessive data collection, inappropriate reuse, insufficient transparency, insecure processing, inaccurate information, data leakage, poor retention practices, or unlawful automated processing.

Generative AI also introduces practical risks when employees submit confidential, proprietary, or personal information to external AI tools without understanding how that information will be handled.

The ICO’s guidance on AI security and data minimization explains that AI can exacerbate established security and data-minimization challenges and should be assessed within the wider data-protection compliance process.

Bias, Discrimination and Fundamental Rights Risk

AI systems can produce unequal outcomes because of data, design decisions, proxy variables, unsuitable deployment contexts, feedback loops, or human reliance on flawed outputs.

Assessment should focus on the real decision process and affected groups rather than relying on one fairness metric as proof that discrimination risk has been eliminated.

The relevant legal assessment will depend on the jurisdiction, sector, purpose, and individuals affected.

Security, Reliability and Operational Risk

Relevant risks can include adversarial attacks, prompt manipulation, sensitive-data exposure, unreliable outputs, unauthorized model changes, poor access controls, integration failures, weak monitoring, and service disruptions.

Operational controls should also account for model and vendor changes that occur after the organization’s initial assessment.

Third-Party and Vendor Risk

Using an external AI platform does not eliminate the need for internal governance.

Supplier due diligence may need to consider security, privacy, data handling, documentation, system limitations, subcontractors, contractual protections, incident notification, model changes, service availability, and the information necessary for the organization’s own compliance assessment.

Vendor monitoring should continue after procurement because AI services can evolve substantially.

How to Build an AI Compliance Program

1. Create an AI Inventory

Start by identifying where AI is actually being used.

The inventory should include internally developed systems, externally purchased tools, embedded AI features, APIs, general-purpose models, generative AI applications, and material employee use of AI services.

Useful inventory fields include:

An incomplete inventory makes nearly every other compliance activity more difficult.

2. Map Applicable Requirements

For each material system, identify relevant:

• AI-specific laws and regulations.

• Privacy obligations.

• Cybersecurity requirements.

• Employment or anti-discrimination requirements.

• Consumer-protection rules.

• Product or safety requirements.

• Sector-specific regulation.

• Contracts and procurement requirements.

• Internal policies.

Then build a requirements map such as:

Requirement → Applicability rationale → Control → Control owner → Evidence → Review date

This creates traceability between legal analysis and operational implementation.

3. Classify AI Risks and Compliance Obligations

Classification should combine legal analysis with organizational risk assessment.

Consider intended purpose, level of autonomy, potential impacts, affected stakeholders, data sensitivity, regulatory classifications, system criticality, and consequences of failure.

Define approval thresholds so higher-impact use cases receive greater scrutiny.

A system should not remain permanently fixed in its original classification. New jurisdictions, data, users, functionality, or decision-making purposes can justify reassessment.

4. Establish AI Policies, Roles and Controls

The organization’s AI policy should translate governance principles into operating rules.

Controls may cover:

• Acceptable AI use.

• AI procurement.

• Development and deployment.

• Risk assessment.

• Privacy.

• Security.

• Human oversight.

• Vendor management.

• Documentation.

• Monitoring.

• Incident response.

• Exceptions.

• Training.

Each significant control should have an owner.

A recurring failure point is to create policies without defining who performs the control, when it occurs, what evidence is produced, or what happens when the control fails.

5. Assess and Test AI Systems Before Deployment

Pre-deployment assessment should reflect the actual use case.

Depending on risk and legal requirements, this can include compliance review, privacy assessment, security assessment, performance evaluation, testing for foreseeable misuse, vendor review, human-oversight assessment, and fairness testing where appropriate.

Testing should use realistic conditions.

A system that performs well in a controlled demonstration may behave differently once connected to organizational data, exposed to new user groups, integrated into workflows, or relied upon under operational pressure.

Approval decisions should record significant assumptions, limitations, unresolved risks, conditions of use, and required monitoring.

6. Maintain Evidence and Documentation

Compliance evidence should be stored systematically rather than assembled only when an audit, customer request, or incident occurs.

A useful evidence structure connects:

System → Requirement → Risk → Control → Owner → Test → Evidence → Decision

Maintain version history for important records.

AI systems may change through new model versions, fine-tuning, prompt changes, configuration updates, datasets, plugins, APIs, vendor modifications, or business integrations. Evidence should make it possible to determine which assessment applied to which version.

7. Monitor AI Systems After Deployment

Monitoring should cover more than technical uptime.

Review performance, incidents, user complaints, security events, model changes, data changes, vendor updates, legal developments, and changes in affected populations or intended purpose.

Useful reassessment triggers include:

• A new model or major version.

• A new jurisdiction.

• A new business purpose.

• New sensitive or personal data.

• Expansion to a new group of affected individuals.

• A material vendor change.

• A significant security or safety incident.

• New regulatory requirements.

• Evidence that system performance has materially changed.

When one of these events occurs, the organization should determine whether the original approval remains valid.

8. Train Relevant Employees and Decision-Makers

Training should reflect employees’ actual roles.

Developers, procurement teams, compliance specialists, HR professionals, managers, security teams, customer-facing staff, and ordinary users of generative AI do not necessarily need identical training.

Relevant topics can include organizational policy, system limitations, privacy, security, acceptable use, escalation, human oversight, regulatory obligations, and incident reporting.

The European Commission’s current AI literacy guidance explains that Article 4 of the AI Act has applied since 2 February 2025 and requires providers and deployers to take measures supporting AI literacy while considering factors such as technical knowledge, experience, education, training, and the context in which AI systems are used. The amended rule does not prescribe a particular individual level of literacy that every person must attain.

Structured AI regulation and compliance training can support organizational capability, but training alone does not create legal compliance.

Common implementation failures across these eight steps include treating an AI policy as the entire compliance program, failing to inventory embedded or third-party AI, relying entirely on supplier claims, confusing framework alignment with legal compliance, failing to document why a risk classification was chosen, and not reassessing systems after material changes.

Which Frameworks Can Support an AI Compliance Program?

NIST AI Risk Management Framework

The NIST AI Risk Management Framework provides a voluntary structure for managing risks associated with AI systems. Its Core is organized around four functions: Govern, Map, Measure, and Manage.

Govern addresses policies, accountability, organizational structures, and risk-management processes.

Map establishes the context in which an AI system operates and identifies risks associated with that context.

Measure supports assessment, analysis, testing, monitoring, and documentation of AI risks.

Manage prioritizes identified risks and establishes responses, monitoring, and improvement.

The associated NIST AI RMF Playbook provides suggested actions for implementing framework outcomes. NIST explicitly states that the Playbook is voluntary and is not a universal checklist or an ordered set of steps that every organization must complete.

As of September 2026, NIST also states that AI RMF 1.0 is being revised. Organizations using it should therefore monitor the official NIST AI RMF page for current versions and supporting material.

ISO/IEC 42001

ISO/IEC 42001:2023 specifies requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System. ISO describes it as an international AI management-system standard designed for organizations that provide or use AI-based products or services.

Its management-system approach can support repeatable organizational processes involving governance, responsibilities, risk management, accountability, monitoring, and continual improvement.

ISO/IEC 42001 can therefore support an organization’s AI compliance program, but implementing the standard does not by itself establish compliance with every applicable law.

How Frameworks and Laws Work Together

A practical organization may therefore use applicable law to determine what it must do, NIST AI RMF to structure risk management, ISO/IEC 42001 to support management-system processes, and internal controls to implement specific requirements.

No single framework guarantees compliance across jurisdictions.

Professionals who need a structured foundation in AI legislation, regulation, and compliance concepts can explore AI Law & Regulation Essentials Training. Training can strengthen regulatory understanding, but it should complement rather than replace organization-specific legal analysis, governance, controls, and monitoring.

How to Keep an AI Compliance Program Current

AI compliance should include both scheduled reviews and event-driven reassessment.

A maintenance program can cover:

• Regulatory monitoring.

• AI inventory review.

• Risk reassessment.

• Policy updates.

• Control testing.

• System changes.

• Vendor monitoring.

• Incident analysis.

• Training updates.

• Evidence review.

• Periodic compliance audits.

The organization should also monitor whether assumptions made during the original approval remain valid.

For example, a system originally approved for internal document assistance may require a different assessment if it is later used to interact with customers, process personal data, recommend employment decisions, or operate in an additional jurisdiction.

This continuous approach is consistent with the NIST AI RMF Core, which treats AI risk management as an ongoing activity across the AI lifecycle rather than a one-time exercise.

AI compliance is an ongoing governance process, not a one-time checklist.

AI Compliance Program Checklist

Use this checklist as a summary, not as a substitute for system-specific legal assessment.

• AI systems and significant AI uses are inventoried.

• Accountable system owners are assigned.

• Intended purposes are documented.

• Relevant jurisdictions are identified.

• Organizational and legal roles are assessed where relevant.

• Applicable laws and regulatory requirements are mapped.

• AI risks are assessed and classified.

• Privacy implications are reviewed where relevant.

• Security risks are assessed.

• Human oversight is defined where appropriate.

• AI policies and approval procedures are established.

• Third-party and vendor risks are assessed.

• Appropriate pre-deployment testing is completed.

• Controls are linked to responsible owners.

• Evidence and version history are retained.

• Relevant employees receive role-based training.

• Post-deployment monitoring is implemented.

• Incident and escalation procedures are established.

• Regulatory and supplier changes are monitored.

• Material changes trigger reassessment.

• Periodic reviews are scheduled.

Conclusion

AI compliance is broader than following one AI regulation or adopting one governance framework.

A defensible program starts by identifying the AI systems an organization uses, determining which requirements apply, assessing risks, assigning accountable owners, implementing proportionate controls, and maintaining evidence showing how those controls operate.

The program must then continue after deployment. New models, vendors, data, business purposes, jurisdictions, incidents, and regulatory changes can all alter the original compliance assessment.

Organizations that treat AI compliance as a structured operating process are better positioned to identify gaps before AI becomes deeply embedded in consequential workflows.

For professionals building their knowledge of AI law and regulation, AI Law & Regulation Essentials Training provides a structured learning route into core AI regulatory and compliance concepts. Education can strengthen internal capability, but it should be used alongside appropriate legal advice, organization-specific governance, risk assessment, controls, and ongoing monitoring.