AI regulatory compliance means making sure the AI systems your company builds or uses follow the laws and standards that govern AI.
In practice, that means knowing which AI you use, which rules apply, and keeping proof that you manage the risks: bias, privacy, security, and transparency. The main rules today are the EU AI Act, a growing set of US state laws, and two voluntary frameworks, ISO/IEC 42001 and the NIST AI Risk Management Framework.
Reviewed by Riya Ann Varghese, GRC Engineer, ISO 27001 lead auditor certified. Last updated October 21, 2026. This guide is not legal advice.
How We Wrote This Guide
AI rules changed several times in 2026, so we checked every date against primary sources: the EU AI Act text, the EU's 2026 Digital Omnibus amendment, state statutes, the NIST AI RMF, and ISO/IEC 42001. The compliance steps come from the SOC 2, ISO 27001, and ISO 42001 programs we support. A GRC engineer reviewed every section. Dates are current as of October 2026.
What Is AI Regulatory Compliance?
AI regulatory compliance is following the legal rules for AI, while AI governance is the internal program you run to meet them.
It is different from using AI to do compliance work, such as AI that answers security questionnaires. That topic is covered in our AI compliance guide. This guide is about the rules your own AI must follow.
AI regulatory compliance applies to two roles. A provider builds an AI system or model. A deployer uses one in its business, for example a chatbot built on a third-party model. Most SaaS companies are deployers, and many are both.
AI Laws and Deadlines at a Glance
The key AI regulations for businesses in 2026 are the EU AI Act (the main set of EU AI regulations), state laws in Colorado, Texas, California, and Illinois, and New York City's hiring rule.
| Rule | Who it applies to | Key date | Status (Oct 2026) |
|---|---|---|---|
| EU AI Act: banned practices | Anyone offering or using AI in the EU | Feb 2, 2025 | In effect |
| EU AI Act: general-purpose AI models | Providers of large AI models | Aug 2, 2025 | In effect |
| EU AI Act: transparency (Art. 50) | Chatbots, deepfakes, AI-generated content | Aug 2, 2026 | In effect |
| EU AI Act: high-risk systems (Annex III) | AI in hiring, credit, education, essential services | Dec 2, 2027 | Delayed from Aug 2026 by the Digital Omnibus |
| EU AI Act: high-risk AI in regulated products | AI built into products like medical devices | Aug 2, 2028 | Delayed |
| New York City Local Law 144 | Employers using AI hiring tools in NYC | Jul 5, 2023 | In effect: yearly bias audits |
| Texas TRAIGA (HB 149) | Developers and deployers in Texas | Jan 1, 2026 | In effect |
| California SB 53 | Developers of very large "frontier" models | Jan 1, 2026 | In effect |
| Illinois HB 3773 | Employers using AI in hiring and job decisions | Jan 1, 2026 | In effect |
| Colorado AI Act (rewritten by SB 26-189) | Developers and deployers of high-impact AI | Jan 1, 2027 | Delayed; enforcement paused by a court in April 2026 |
Dates change often. Check the status with counsel before you commit to a plan.
What Does the EU AI Act Require?
The EU AI Act sorts AI systems into four risk levels and sets stricter rules the higher the risk.
| Risk level | Examples | What you must do |
|---|---|---|
| Unacceptable (banned) | Social scoring, manipulative AI, emotion recognition at work | Do not use them |
| High risk | CV screening, credit scoring, exam grading | Risk management, data quality, logging, human oversight, documentation |
| Limited risk | Chatbots, AI-generated images and text | Tell people they are dealing with AI, label AI content |
| Minimal risk | Spam filters, AI in games | No new obligations |
These EU AI regulations reach companies outside the EU if their AI is used in the EU or its output is used there. A US SaaS company with EU customers can be in scope.
Fines go up to €35 million or 7% of worldwide annual turnover for banned practices, up to €15 million or 3% for most other breaches, and up to €7.5 million or 1% for giving regulators wrong information.
In 2026 the EU passed the Digital Omnibus on AI, which delayed the high-risk rules to December 2, 2027. It did not delay the bans or the transparency rules.
What Are the AI Regulations in the US?
The US has no single federal AI law, so AI is regulated through state laws, city rules, and existing federal laws that already apply to AI.
- Federal AI regulations: there is no comprehensive federal AI law yet. Executive Order 14365 (December 2025) set up a Department of Justice task force to challenge state AI laws seen as too strict. It does not cancel any state law, and law firms advise continuing to comply. Existing laws still apply to AI, including the FTC Act on unfair or deceptive practices, fair lending rules, and HIPAA.
- Texas: TRAIGA bans certain intentional harmful uses of AI, such as unlawful discrimination and manipulation. The Attorney General enforces it, with a 60-day cure period, and following the NIST AI RMF can support a defense.
- California: SB 53 requires the largest frontier model developers to publish a safety framework and report serious safety incidents.
- Colorado: the original AI Act was rewritten in 2026 and delayed to January 1, 2027. A federal court paused enforcement in April 2026 while a challenge is heard.
- Hiring: New York City requires yearly bias audits of automated hiring tools, and Illinois bans discriminatory use of AI in employment decisions.
AI Compliance Frameworks: ISO 42001 and NIST AI RMF
An AI compliance framework is a voluntary standard that gives you a structured way to manage AI risk and prove it to customers and regulators.
| Framework | What it is | Certifiable? | Best for |
|---|---|---|---|
| ISO/IEC 42001 (Dec 2023) | A management system standard for AI, like ISO 27001 for AI | Yes, by an accredited body | Proving AI governance to enterprise customers |
| NIST AI RMF 1.0 (Jan 2023) | A risk framework with four functions: Govern, Map, Measure, Manage | No | Structuring your AI risk program, US defenses like Texas |
| NIST AI 600-1 (Jul 2024) | A generative AI profile of the AI RMF | No | Companies building on large language models |
ISO 42001 fits easily next to ISO 27001 because both use the same management system structure. Our ISO 42001 guide explains certification step by step.
Building an AI Regulatory Compliance Program
An AI regulatory compliance program is the set of owners, policies, and routines a company uses to meet AI rules every year, not just once.
AI laws keep changing, so a one-time project goes out of date fast. A program gives you a repeatable way to spot new rules, check your AI against them, and keep proof. Most companies build it on top of the security program they already run for SOC 2 or ISO 27001. These are the six parts most programs need:
| Program part | What it means | Evidence to keep |
|---|---|---|
| Owner and oversight | One person accountable for AI compliance, plus a small group from legal, security, engineering, and product that approves new AI uses | Named owner, meeting notes, approval records |
| AI policy | Rules for which AI tools are approved, what data can go into them, and who can build AI features | Signed AI policy and staff acknowledgements |
| AI inventory | A living list of every AI system you build or buy, with its owner, data, and risk level | AI register, updated when tools are added |
| Risk and impact assessment | A repeatable way to check bias, privacy, security, and misuse before launch and after big changes | Risk register entries and impact assessments |
| Framework | ISO 42001 or the NIST AI RMF as the structure, mapped to your existing SOC 2 or ISO 27001 controls | Control mapping, and a Statement of Applicability for ISO 42001 |
| Monitoring and review | Track new laws, test AI output, log incidents, and review the whole program at least once a year | Review records, test results, incident logs |
Start small. A named owner, an AI policy, and an AI inventory answer most of the AI questions customers ask in security questionnaires today. The 8-step checklist below turns the program into tasks.
How UprootSecurity Helps With AI Compliance
UprootSecurity lets you run AI compliance alongside your existing SOC 2 and ISO 27001 program, with one set of controls and evidence.
- ISO 42001 support: controls and policies for an AI management system, mapped to your ISO 27001 controls.
- Risk and vendor management: score AI risks and review AI providers in the same register.
- Continuous monitoring: checks across 140+ integrations keep evidence current for every framework.
→ See how it works: book a demo
How SOC 2, ISO 27001, and HIPAA Apply to AI
SOC 2, ISO 27001, and HIPAA do not mention AI by name, but their existing controls cover AI systems that handle your data.
| Framework | Where AI fits | What auditors look for |
|---|---|---|
| SOC 2 | AI is part of your system if it touches customer data. CC3 (risk), CC6 (access), CC7 (monitoring), CC9.2 (vendors) | AI tools in your risk assessment, vendor reviews of AI providers, access controls on AI systems |
| ISO 27001 | Clause 6.1 risk assessment, A.5.9 asset inventory, A.5.19 to A.5.23 suppliers and cloud, A.8.25 to A.8.28 secure development | AI systems in the asset inventory and risk register, supplier agreements with AI vendors |
| HIPAA | Any AI that creates, receives, or stores protected health information | A business associate agreement with the AI vendor, and AI included in the HIPAA risk analysis |
The practical rule: treat every AI tool like any other vendor or system. Inventory it, assess its risk, review the provider, and control who can use it. Our trust services criteria guide and ISO 27001 requirements guide cover these controls in more detail.
AI Compliance Checklist: 8 Steps
To start AI regulatory compliance, list your AI systems, sort them by risk, and build the evidence each rule asks for.
- Inventory every AI system, including AI features inside tools you buy. Record the owner, data used, users, and decisions it affects.
- Classify each one by EU AI Act risk level and by which US AI regulations could apply.
- Assess AI risks such as bias, privacy, security, and misuse, and add them to your risk register.
- Review AI vendors. Check their security reports, sign data processing agreements, and get a BAA if health data is involved.
- Set human oversight for any AI that affects decisions about people.
- Be transparent. Tell users when they talk to AI and label AI-generated content.
- Test and monitor AI output for accuracy and bias, and log incidents.
- Write an AI policy and train staff on approved tools and what data they must never paste into AI.
This AI compliance checklist works whether or not a specific AI law applies to you yet. Keep the evidence for each step in one place. The same records serve the EU AI Act, ISO 42001, SOC 2, and ISO 27001.
How UprootSecurity Approaches Compliance
Knowing which AI rules apply is the first step. Proving you follow them, alongside your other frameworks, is the work that follows.
| What you need | How UprootSecurity handles it |
|---|---|
| An AI management system | ISO 42001 controls and policies, mapped to ISO 27001 |
| AI risks in your register | Risk management with scoring, owners, and treatment plans |
| AI vendor reviews | Third-party risk management in the same platform |
| Evidence that stays current | Continuous monitoring across 140+ integrations |
| Guidance for your team | A dedicated compliance expert through readiness and the audit |
| A clear price | A custom quote based on your scope, with a yearly penetration test in every plan |
UprootSecurity is a compliance platform for startups and scaleups that need SOC 2, ISO 27001, ISO 42001, HIPAA, or other frameworks. See our plans.
Frequently Asked Questions
AI regulatory compliance means making sure the AI systems your company builds or uses follow the laws and standards that govern AI. It covers knowing which AI you use, which rules apply, and keeping proof that you manage risks like bias, privacy, security, and transparency. Main rules include the EU AI Act and US state laws.
The main regulations governing AI are the EU AI Act, US state laws in Texas, California, Colorado, and Illinois, and New York City's rule on AI hiring tools. Existing laws also apply to AI, such as GDPR, HIPAA, and US consumer protection law, which for now does most of the work of federal AI regulations. ISO 42001 and the NIST AI RMF are voluntary frameworks that support compliance.
The EU AI Act applies in stages. Bans on prohibited AI started February 2, 2025, and rules for general-purpose AI models started August 2, 2025. Transparency rules apply from August 2, 2026. After the 2026 Digital Omnibus, rules for high-risk AI start December 2, 2027, or August 2, 2028, for AI in regulated products.
Yes, the EU AI Act can apply to US companies. It covers providers that place AI on the EU market and companies whose AI output is used in the EU, wherever they are based. A US SaaS company with EU customers using an AI feature may need to meet the transparency or high-risk rules.
Fines under the EU AI Act reach up to 35 million euros or 7% of worldwide annual turnover for banned AI practices, whichever is higher. Most other breaches can cost up to 15 million euros or 3%, and giving regulators incorrect information up to 7.5 million euros or 1%. Smaller companies face the lower of the two amounts.
The best AI compliance framework for most companies is ISO/IEC 42001 if customers want a certificate, or the NIST AI RMF if you need a free structure for managing AI risk. Many companies use both: NIST AI RMF to organize the work and ISO 42001 to certify it, alongside existing ISO 27001 or SOC 2 controls.
Yes, SOC 2 covers AI systems that are part of the system in scope, even though the criteria do not mention AI by name. Auditors expect AI tools to appear in your risk assessment, AI providers to go through vendor review, and access to AI systems to be controlled. SOC 2 does not prove compliance with AI laws.
Yes, HIPAA applies to any AI tool that creates, receives, stores, or sends protected health information for a covered entity or business associate. You need a business associate agreement with the AI vendor, and the AI system must be part of your HIPAA risk analysis. Staff should not paste patient data into unapproved AI tools.
Start an AI compliance program by listing every AI system you build or use, including AI features inside purchased tools. Then classify each by risk, assess bias, privacy, and security risks, review AI vendors, set human oversight, and write an AI policy. Keep evidence in one place so it serves several frameworks.
