AI Compliance & Regulatory Frameworks

The world's first comprehensive AI regulatory framework. Takes a risk-based approach, categorizing AI systems into four risk tiers: unacceptable risk (banned), high risk (regulated), limited risk (transparency obligations), and minimal risk (voluntary codes). Applies to providers, deployers, importers, and distributors placing AI systems on the EU market.

The NIST AI Risk Management Framework provides voluntary guidance for managing AI-related risks across organizations. Organized around four core functions: GOVERN, MAP, MEASURE, and MANAGE. Widely adopted as best practice guidance and referenced in US federal contracts and procurement.

The first international standard for AI Management Systems (AIMS). Provides a certifiable framework for responsible AI development and deployment, analogous to ISO 27001 for information security. Enables organizations to demonstrate third-party verified AI governance maturity.

The General Data Protection Regulation (GDPR) imposes significant requirements on AI systems that process personal data of EU residents. Applies from training data collection through to AI inference and decision-making. Enforced by national Data Protection Authorities (DPAs) across 27 EU member states.

UK's approach to AI safety combines the AI Safety Institute (AISI) for frontier AI evaluation, sector-specific guidance from regulators, and a principles-based voluntary code. Pro-innovation in stance compared to EU AI Act - sector regulators (FCA, ICO, CMA) apply existing powers to AI rather than a single AI law.

Executive Order 14110 on Safe, Secure, and Trustworthy AI, signed October 30, 2023. Requires safety testing reports from frontier AI developers, establishes federal AI governance, and directs 50+ agencies to develop sector-specific AI guidance. Key threshold: models trained with >10^26 FLOPs must report to government.

China has the world's most active AI regulatory environment, with multiple overlapping rules: Interim Measures for Generative AI (Aug 2023), Algorithm Recommendation Regulations (Mar 2022), Deep Synthesis (Deepfake) Regulations (Jan 2023), and Cross-Border Data Transfer Rules. Enforced by CAC (Cyberspace Administration of China).

IEEE's Ethically Aligned Design (EAD) is a comprehensive voluntary framework for ethical AI and autonomous systems. Developed by 700+ global experts. Covers human rights, well-being, data agency, effectiveness, transparency, accountability, and the prevention of AI weaponization. Widely referenced in engineering ethics education and AI governance policies.

AIDA was Canada's proposed federal AI regulation, introduced as Part 3 of Bill C-27 with a risk-based approach similar to the EU AI Act. IT NEVER BECAME LAW. Bill C-27 died when Parliament was prorogued on 5 January 2025, and a bill that dies at prorogation does not carry over. No successor bill has been tabled, and the Minister of Artificial Intelligence and Digital Innovation created after the April 2025 election has said AIDA will not return as drafted. Canada has no comprehensive federal AI statute: AI is governed by PIPEDA, Quebec's Law 25 automated-decision rules, the voluntary ISED code of conduct for generative AI, and sector-specific directives. This entry is retained because AIDA is still widely and wrongly cited as current Canadian law.

Singapore's Model AI Governance Framework provides detailed practical guidance for private sector organizations deploying AI. Developed by PDPC, emphasizes human-centric AI with detailed implementation guides. Supplemented by AI Verify - an AI governance testing toolkit and certification program.

Australia's AI Ethics Framework provides eight principles for ethical AI. Supplemented by mandatory guardrails for Australian government high-risk AI procurement (2024). The government is developing a risk-based regulatory approach, with regulation anticipated in high-risk domains (automated decisions, biometrics, critical infrastructure).

The OECD Principles on Artificial Intelligence were adopted May 2019 and endorsed by G20 leaders - the first intergovernmental AI standard. They form the foundation for most national AI regulatory frameworks globally. The OECD.AI Policy Observatory tracks global implementation across 70+ countries.

The G7 Hiroshima AI Process was launched at the 2023 G7 Summit to develop international guiding principles specifically for advanced AI/foundation models. Produced 11 International Guiding Principles and a voluntary Code of Conduct for AI developers. Focus on frontier model safety, transparency, and watermarking.

India's Digital Personal Data Protection Act 2023 establishes comprehensive data protection for digital personal data of Indian citizens. Significant implications for AI systems processing personal data - including training, inference, and automated decision-making affecting Indian individuals.

SOC 2 Type II has become the de facto security and trust certification for AI SaaS companies. Auditors are developing AI-specific criteria covering model governance, training data security, bias testing, and algorithmic fairness alongside traditional Trust Service Criteria (TSC).

The US Federal Trade Commission applies existing consumer protection and competition laws (Section 5 FTC Act) to AI systems - prohibiting deceptive AI capability claims, biased algorithms causing discriminatory harm, and unfair AI-driven practices. The FTC is actively investigating and taking enforcement action against AI companies.

The FDA regulatory framework for AI/ML-based Software as a Medical Device (SaMD) addresses how AI models can be continuously updated post-deployment while maintaining safety and effectiveness. Requires pre-market submission for high-risk devices, post-market surveillance, and a Predetermined Change Control Plan for AI updates.

Brazil's AI Bill (PL 2338/2023) was approved by the Brazilian Senate in June 2024 and is under review in the Chamber of Deputies. Inspired heavily by the EU AI Act, it adopts a risk-based classification approach (minimal, limited, high risk), establishes AI governance requirements, and creates an oversight authority. Brazil is the 8th-largest economy and home to 215 million people — the largest AI regulatory jurisdiction in Latin America.

South Korea's Framework Act on the Development of Artificial Intelligence and Establishment of Trust (AI Basic Act) was enacted in January 2024 and enters into force in January 2026. It is the first comprehensive AI law in East Asia (outside China) and takes a risk-based approach distinguishing high-impact AI requiring transparency and conformity assessment from general AI. Enforced by the Ministry of Science and ICT (MSIT).

Japan's Ministry of Economy, Trade and Industry (METI) and Cabinet Office published the AI Guidelines for Business in April 2024 — a voluntary, principles-based framework for responsible AI development and use. Japan takes a notably pro-innovation stance: rather than binding AI-specific legislation, it relies on existing laws (Act on Protection of Personal Information, copyright law, Unfair Competition Prevention Act) supplemented by voluntary guidance. The framework strongly emphasizes human-centricity, sustainability, and international interoperability, aligning with OECD AI Principles and G7 Hiroshima AI Process commitments.

The UAE was the first country in the world to appoint a Minister of State for Artificial Intelligence (2017) and launched the UAE National AI Strategy 2031 — aiming to make the UAE a global AI hub and derive 50% of government services from AI by 2031. The UAE combines aspirational AI adoption with a sector-specific regulatory approach: the CBUAE (Central Bank) and TDRA (Telecommunications and Digital Government Regulatory Authority) issue AI-specific guidance for their sectors. The UAE's AI governance model is pro-innovation and explicitly designed to attract AI companies and investment.

The EU Cyber Resilience Act (Regulation 2024/2847) establishes mandatory cybersecurity requirements for products with digital elements placed on the EU market — including AI-enabled software, connected hardware, and AI components embedded in products. Signed into law October 2024, it fills a critical gap alongside the EU AI Act by ensuring AI-powered products meet baseline security-by-design requirements throughout their lifecycle.

The Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law is the world's first legally binding international treaty on AI. Opened for signature in September 2024, it commits signatory states — including non-European nations such as the United States, United Kingdom, Canada, Japan, and Israel — to ensure that activities within the AI lifecycle are consistent with human rights, democratic values, and the rule of law. Unlike the EU AI Act's product-safety approach, the Convention sets state-level obligations and principles rather than technical product requirements.

Colorado passed the first comprehensive US state-level AI law (SB 24-205) in May 2024, imposing a duty of reasonable care on developers and deployers of 'high-risk' AI to prevent algorithmic discrimination in consequential decisions. It never took effect. Its start date was pushed from February 2026 to June 2026, a federal magistrate judge stayed enforcement in April 2026 amid a constitutional challenge the US Department of Justice joined, and on 14 May 2026 Governor Polis signed SB 26-189, which repeals and replaces it. The replacement drops the risk-based duty-of-care model for a narrower transparency framework covering automated decision-making technology (ADMT), and takes effect 1 January 2027. Plan against SB 26-189, not against the original Act.

Texas's comprehensive AI law (HB 149), signed in 2025, taking a duty-and-prohibition-based approach rather than a broad risk-tier system. It bars specific harmful uses of AI — intentional discrimination, manipulation to incite self-harm or crime, unlawful biometric identification, and certain non-consensual intimate or child-exploitation content — and imposes transparency duties on government agencies using AI to interact with consumers. It creates a regulatory 'sandbox' for AI innovation and vests exclusive enforcement in the Texas Attorney General with a cure period before penalties.

California's frontier-AI safety and transparency law (SB 53), signed in 2025, targeting the largest developers of the most capable 'frontier' AI models. Rather than a broad risk-tier regime, it imposes transparency, safety-framework publication, and critical-incident reporting duties on frontier developers above defined compute and revenue thresholds, and adds whistleblower protections for employees raising catastrophic-risk concerns. It reflects a shift toward regulating advanced foundation models at the point of development.

Saudi Arabia's national AI governance approach, led by the Saudi Data and Artificial Intelligence Authority (SDAIA). It centers on the AI Ethics Principles and supporting frameworks that guide responsible AI development and deployment across public and private sectors, aligning with the Kingdom's Vision 2030 and its National Strategy for Data and AI (NSDAI). The approach is principles-based and risk-tiered, emphasizing fairness, transparency, accountability, privacy, and human oversight rather than a single binding AI statute.

New York City's Local Law 144 regulates the use of Automated Employment Decision Tools (AEDTs) in hiring and promotion decisions for positions in New York City. It requires employers and employment agencies to have AEDTs independently bias-audited within the prior year, to publicly post a summary of the audit results, and to notify candidates and employees before using such tools. It is one of the first US laws specifically targeting AI in hiring, enforced by the NYC Department of Consumer and Worker Protection.

Illinois House Bill 3773 amends the Illinois Human Rights Act to expressly regulate employers' use of artificial intelligence in employment decisions. It makes it a civil rights violation for an employer to use AI that has a discriminatory effect on employees or applicants on the basis of protected classes, or to use ZIP codes as a proxy for protected classes. It also requires employers to notify employees and applicants when AI is used in recruitment, hiring, promotion, discipline, discharge, and other terms of employment, building on Illinois' earlier AI Video Interview Act.

The reference list of the most critical security risks in applications built on large language models and AI agents. Unlike governance frameworks, which address process and accountability, this addresses the application layer directly: what an attacker does to an LLM system and how engineering teams prevent it. Widely used to structure security review and penetration testing of generative AI features.

Guidance on managing risk specific to artificial intelligence, adapting the general ISO 31000 risk management approach to AI systems. Where ISO/IEC 42001 specifies a certifiable management system, 23894 supplies the risk methodology used inside it — how AI risk is identified, analysed, evaluated, and treated across the system lifecycle.

Published in May 2025, ISO/IEC 42005 gives organisations a structured method for assessing how an AI system — and its foreseeable uses — may affect individuals, groups, and society. It completes the ISO AI trio: 42001 specifies the certifiable management system, 23894 supplies the risk methodology, and 42005 supplies the impact assessment that both reference. It is guidance rather than a certifiable standard: there is no external auditor and no certificate, and it is used internally to make impact assessment repeatable and documented.

The voluntary code providers of general-purpose AI models can sign to demonstrate compliance with their EU AI Act obligations. The AI Office published the final version on 10 July 2025 after a process involving close to 1,000 stakeholders, and the Commission and AI Board confirmed it as an adequate means of demonstrating compliance. It has three chapters: transparency and copyright, which apply to all GPAI model providers, and safety and security, which applies only to providers of models with systemic risk.

The voluntary code for meeting the Article 50 transparency duties of the EU AI Act, covering disclosure that content is AI-generated and the machine-readable marking that makes it detectable. The Commission published its final Article 50 guidelines on 20 July 2026 and confirmed this code as an adequate means of demonstrating compliance. It is the transparency counterpart to the General-Purpose AI Code of Practice: that one addresses model providers, this one addresses whoever generates or manipulates content that reaches people.

In force since 1 January 2026, AB 2013 requires developers of generative AI systems made available to Californians to publish a high-level summary of the datasets used to train them, covering systems released or substantially modified since January 2022. It is the first US law to force training-data disclosure, and it applies to anyone who designs, codes, produces, or substantially modifies a public generative AI system — not only large model developers.