AI compliance frameworks

United States Federal

FedRAMP is the U.S. federal program that standardizes security assessment, authorization, and continuous monitoring for cloud services used by federal agencies. AI governance vendors serving federal or defense customers typically need FedRAMP Moderate or High authorization.

United States

HIPAA governs the privacy and security of Protected Health Information (PHI) in the United States. AI vendors operating in healthcare must meet HIPAA Security Rule requirements (access controls, audit logs, integrity, encryption) and sign BAAs with covered entities. HIPAA applies directly to many AI use cases in clinical decision support, diagnostics, and healthcare operations.

International (ISO)

ISO/IEC 27001 is the international standard for information security management systems (ISMS). It complements ISO/IEC 42001 (AI management systems) and is often held by AI governance vendors as a baseline information-security certification. Required by many enterprise procurement processes globally.

International (PCI SSC)

PCI DSS governs the handling of payment card data. AI vendors serving fintech, retail, and payment processors often need to demonstrate PCI DSS alignment when their platforms touch cardholder data or are integrated with payment flows.

United States (AICPA)

SOC 2 is an AICPA auditing standard for service organizations, evaluating controls relevant to security, availability, processing integrity, confidentiality, and privacy. While not AI-specific, SOC 2 Type II reports are table stakes for B2B SaaS vendors — including AI governance platforms — and are frequently mapped to AI-specific risk frameworks.

United States - California

The California Consumer Privacy Act, as amended by the California Privacy Rights Act (CPRA), applies to for-profit businesses that do business in California and meet at least one threshold: gross annual revenue over $25 million; buy, sell, or share personal information of 100,000+ California residents/households; or derive 50%+ of annual revenue from selling California residents' personal information. The California Privacy Protection Agency (CPPA) has issued draft regulations governing Automated Decision-Making Technology (ADMT), risk assessments, and cybersecurity audits under CCPA authority. Enforcement is shared between the CPPA and the California Attorney General.

European Union

Regulation (EU) 2022/2554 (DORA) governs digital operational resilience for the EU financial sector. It applies to financial entities — including credit institutions, payment institutions, investment firms, crypto-asset service providers, insurance and reinsurance undertakings, and 20+ other entity types — and to ICT third-party service providers serving them. Financial entities must implement an ICT risk management framework, an ICT incident management process, digital operational resilience testing, and third-party ICT risk management. The regulation applies from 17 January 2025.

EU

The EU AI Act (Regulation (EU) 2024/1689) regulates AI systems placed on the EU market according to risk. It applies in phases: prohibited practices since February 2, 2025; general-purpose AI model obligations since August 2, 2025; and Article 50 transparency obligations from August 2, 2026. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since July 27, 2026) deferred the high-risk system obligations: stand-alone Annex III systems now apply from December 2, 2027 and AI embedded in Annex I regulated products from August 2, 2028.

EU

Article 22 of the EU General Data Protection Regulation gives data subjects the right not to be subject to a decision based solely on automated processing — including profiling — that produces legal effects concerning them or similarly significantly affects them. The right applies across the EU and EEA and has been in force since May 25, 2018. The European Data Protection Board's Guidelines 1/2024 (adopted December 2024) clarify the scope, including how it applies to large language models and recommender systems. The CJEU's SCHUFA ruling (Case C‑634/21, December 2023) confirmed that automated credit scoring constitutes a "decision" under Article 22 where the score effectively determines whether a loan or contract is granted. Enforcement is by national Data Protection Authorities; penalties for Article 22 violations fall under the GDPR's higher tier — up to €20 million or 4% of worldwide annual turnover.

European Union

Directive (EU) 2022/2555 (NIS2) is the EU's second-generation cybersecurity directive. It requires medium-sized and large entities across critical sectors — energy, transport, healthcare, finance, water, digital infrastructure, digital service providers, waste, critical manufacturing, postal services, public administration, and space — to implement cybersecurity risk management measures and notify national authorities of significant incidents. Member States were required to transpose NIS2 into national law by 17 October 2024.

US

New York City Local Law 144 of 2021 prohibits employers and employment agencies from using an automated employment decision tool (AEDT) to screen a candidate or employee for a position located in NYC unless the tool has been the subject of a bias audit conducted no more than one year before its use. The law has been in force since July 5, 2023 and is enforced by the NYC Department of Consumer and Worker Protection. Penalties start at $500 for a first violation and $500–$1,500 per subsequent violation, with each day a non-compliant tool is used counted as a separate violation. The required audit must measure selection rates and impact ratios across sex, race/ethnicity, and intersectional categories, with results published on the employer's public-facing website.

US

The SEC has brought enforcement actions and issued guidance requiring public companies to accurately disclose their use of AI in securities filings, avoid "AI washing," and ensure investment advisers do not misrepresent their use of AI in client communications.

US

Colorado’s original AI Act, SB 24-205, was repealed and replaced in May 2026 by SB 26-189, a narrower law on automated decision-making technology (ADMT) used in consequential decisions about consumers in areas such as employment, education, housing, financial services, insurance, healthcare and essential government services. SB 26-189 takes effect January 1, 2027. It shifts from SB 24-205’s risk-management and impact-assessment regime to a notice-based approach: developers must give deployers documentation about intended uses, known limitations and training-data categories; deployers must notify consumers that ADMT is used and, after an adverse outcome, explain the decision within 30 days and offer data correction and human review where commercially reasonable. Enforcement is by the Colorado Attorney General, with a 60-day cure period that sunsets January 1, 2030.

United States - Texas

The Texas Responsible Artificial Intelligence Governance Act (TRAIGA, HB 149) took effect on January 1, 2026. It prohibits developing or deploying AI with the intent to engage in specified harmful practices, sets disclosure duties for governmental entities and certain health-care uses, creates a regulatory sandbox, and is enforced by the Texas Attorney General, with an opportunity to cure before enforcement.

Global

ISO/IEC 42001:2023 is the first international management-system standard for artificial intelligence, published in December 2023 jointly by ISO and IEC. It specifies requirements for establishing, implementing, maintaining, and continually improving an AI management system (AIMS) within an organisation. The standard follows the harmonised high-level structure used by ISO 27001 and ISO 9001, making integration with existing management systems straightforward. ISO 42001 is voluntary but is the most credible signal a vendor or operator can provide that AI risk is governed at the management-system level. Certification is granted by accredited third-party certification bodies (the ISO/IEC body itself does not issue certificates) and follows a typical 3-year cycle with annual surveillance audits.

US

The NIST AI Risk Management Framework (AI RMF 1.0) was published by the U.S. National Institute of Standards and Technology in January 2023, with a Generative AI Profile (NIST-AI-600-1) added in July 2024. It is a voluntary, sector-agnostic framework that organises AI risk management around four functions: Govern, Map, Measure, and Manage. Although adoption is voluntary, the AI RMF is referenced by the U.S. Executive Order on AI, several federal agency directives, and is increasingly cited by procurement teams and insurance carriers as a baseline expectation. NIST also publishes a companion AI RMF Playbook with concrete implementation suggestions and a Crosswalk that maps AI RMF actions to ISO/IEC 42001, ISO/IEC 23894, OECD AI Principles, and EU AI Act provisions.

UK

The UK's pro-innovation, context-specific approach to AI regulation relies on existing regulators (ICO, FCA, CMA, MHRA, Ofcom) applying five cross-sectoral principles: safety; transparency; fairness; accountability; and contestability. A central AI Safety Institute evaluates frontier models.