EU AI Act, NIST AI RMF, and SOC 2 alignment
Regulatory &
Compliance
The regulatory landscape for AI is moving from uncertainty to obligation. The EU AI Act is enforceable. NIST AI RMF adoption is expected by US federal contractors and partners. ISO 42001 is emerging as the global certification standard. Organizations that treat AI compliance as a future problem are accumulating regulatory debt — and measurable legal exposure — today.
Why It Matters
EU AI Act penalties for non-compliance in prohibited and high-risk categories reach €35 million or 7% of global annual revenue — whichever is higher. Beyond fines, regulatory investigations, class-action risk from AI bias and discrimination claims, and customer due diligence requirements from enterprise buyers are creating concrete commercial consequences for organizations with weak compliance postures. Regulators are not waiting for organizations to self-regulate. The frameworks are published, the obligations are clear, and early enforcement is already underway.
Regulatory Context
The EU AI Act entered into force in August 2024, with prohibited AI practices banned from February 2025 and the amended high-risk timetable distinguishing Annex III systems (2 December 2027) from Annex I product-related systems (2 August 2028). See the linked EU AI Act guide for scope, role-specific duties, exceptions and primary sources. NIST AI RMF (2023) provides a voluntary framework that is increasingly referenced in US federal procurement. ISO 42001 (2023) is the first internationally recognized AI management system standard.
Key Dimensions
The assessment evaluates Regulatory & Compliance across four questions, each targeting a distinct governance dimension:
Systematic tracking of AI-specific regulations and standards as they evolve — including the EU AI Act, NIST AI RMF, ISO 42001, US state AI legislation, and sector-specific guidance from financial, healthcare, and critical infrastructure regulators.
Documentation and classification of AI systems by risk level per applicable regulatory frameworks — particularly the EU AI Act's unacceptable, high, limited, and minimal risk categories — with mapping to specific regulatory obligations.
Processes for collecting, maintaining, and producing evidence of AI governance controls — including technical documentation, conformity assessments, model cards, and decision audit trails — ready for regulator or customer inspection.
Active management of AI-related legal risks including intellectual property ownership in AI-generated outputs, liability allocation for AI decisions, and bias and discrimination exposure — reviewed regularly with legal counsel.
What Optimizing Looks Like
An organization scoring in the Optimizing range (76–100) on Regulatory & Compliance demonstrates:
- →A formal AI compliance program with named legal and compliance ownership, not delegated to IT or engineering alone
- →Comprehensive, documented AI risk classification with explicit mapping to EU AI Act risk categories and NIST AI RMF profiles
- →Automated audit evidence collection with maintained, queryable audit trails and version-controlled technical documentation
- →A legal risk framework covering IP ownership, liability allocation, and anti-discrimination obligations — reviewed with counsel at least annually
Assessment Questions
The following four questions make up the Regulatory & Compliance domain in the assessment. Each is scored 0–3, for a maximum of 12 raw points (normalized to 0–100).
How does your organization track and respond to AI-specific regulations (EU AI Act, NIST AI RMF, ISO 42001, etc.)?
Are your high-risk AI systems classified and documented per applicable regulatory standards?
Does your organization have processes for AI-related audit evidence collection?
How are AI-related legal risks (IP ownership, liability, bias and discrimination) actively managed?
Share This Page
Use this as a conversation starter with prospects or board members.
See how this domain fits into the full assessment → Assessment Methodology