Overview

Anastazja Kowalska was Chief Compliance Officer at a mid-sized Polish fintech when the EU AI Act passed. Her legal team sent her a 47-page summary. Her CEO asked her to explain the implications in five minutes. "The honest answer," she told me, "was that it depended entirely on what systems we were running and how we were using them. There is no single answer. There is a classification exercise, and then a compliance plan, and the complexity scales with the risk classification." She spent the next three months building exactly that - a systematic way to understand where her organization stood under a regulatory framework that was still being defined.

The AI regulatory landscape is moving faster than almost any previous technology domain. For practitioners in organizations deploying AI, this creates a specific challenge: you need to understand what rules apply now, anticipate what rules are coming, and build compliance processes that can adapt as the landscape changes.

This lesson provides a practical framework for that navigation.

The Current Regulatory Landscape

AI regulation is developing simultaneously at multiple levels: international frameworks, regional legislation, national laws, and sector-specific requirements. No single framework governs all AI globally. The relevant rules depend on where your organization operates, what sectors you are in, what AI systems you run, and who those systems affect.

The EU AI Act is the most comprehensive AI-specific legislation enacted to date. It came into force in 2024 and is phasing in requirements over a period through 2026 and beyond. Its central structure is a risk-based classification system:

• *Unacceptable risk:* AI systems that are prohibited outright. These include social scoring systems, real-time biometric surveillance in public spaces (with narrow exceptions), and AI systems that exploit vulnerabilities to manipulate behavior.
  - *High-risk:* AI systems used in specified domains (employment, credit, healthcare, critical infrastructure, law enforcement, education) that are subject to extensive requirements including conformity assessment, technical documentation, human oversight, data quality standards, and registration in a public database.
  - *Limited risk:* AI systems where transparency obligations apply - primarily, notifying users when they are interacting with AI (chatbots, deepfakes).
  - *Minimal risk:* All other AI systems, which are subject only to voluntary codes of conduct.

The Act applies to organizations that place AI systems on the EU market or use them in the EU - regardless of where those organizations are based. A US company deploying AI to serve EU customers is subject to the Act for those deployments.

General data protection regulation (GDPR) predates the AI Act but intersects with it significantly. GDPR governs the processing of personal data. Since most AI training involves personal data, and since many AI applications process personal data, GDPR compliance is a baseline requirement for AI deployments in Europe. Key provisions relevant to AI: the right to explanation for automated decisions, data minimization requirements, purpose limitation, and the requirement for a lawful basis for processing.

Sector-specific regulation layers additional requirements. Financial services organizations face AI-relevant requirements from banking regulators (stress-testing, model risk management), insurance regulators (actuarial fairness), and consumer protection authorities. Healthcare organizations face requirements from medicines regulators and medical device authorities. These sectoral requirements often predate AI-specific legislation and apply independent of AI Acts.

National AI strategies and laws are proliferating. The US has executive orders on AI and a patchwork of state-level legislation emerging. The UK has adopted a principles-based approach through sector regulators rather than a single AI Act. China has enacted specific rules on generative AI and recommendation algorithms. Canada, Brazil, and other jurisdictions are in various stages of AI legislation development.

How to Determine What Applies to You

Regulatory compliance starts with classification. Anastazja built a four-step classification process for her organization.

Step 1: Inventory your AI systems. List every AI system your organization deploys or procures. Include not just systems your team built, but AI features embedded in commercial software you use. The AI-powered credit scoring embedded in your loan origination software is a high-risk AI system under the EU AI Act, even if you did not build it.

Step 2: Classify by risk level. For each system, determine its risk classification under applicable frameworks. The EU AI Act's high-risk categories are a useful starting point even for organizations not directly subject to it. Any system affecting employment, credit, healthcare, or critical infrastructure decisions should be treated as high-risk.

Step 3: Map applicable requirements. For each system at each risk level, identify the specific requirements that apply: documentation requirements, human oversight requirements, testing and validation requirements, disclosure requirements, registration requirements. Build a compliance matrix - a table with systems on one axis, requirements on the other, and current compliance status in the cells.

Step 4: Identify gaps and build a remediation plan. For each gap between current practice and required practice, estimate the effort required to close it and assign a timeline. Prioritize by: seriousness of the compliance gap, proximity of enforcement dates, and risk exposure if the gap is not closed.

Building for Regulatory Change

The regulatory landscape is not stable. Requirements will expand. New jurisdictions will enact rules. Existing rules will be revised through enforcement guidance and case law.

Three practices build adaptive compliance capacity.

Regulatory monitoring as a routine function. Assign someone to track AI regulatory developments in your relevant jurisdictions. This does not require a dedicated compliance attorney. It requires a structured process: subscribe to regulatory newsletters, monitor the legislative calendars of relevant jurisdictions, and maintain relationships with industry associations that provide regulatory intelligence to members.

Build compliance into development, not onto it. Organizations that treat compliance as a review gate at the end of AI development are always slower and more expensive than organizations that build compliance considerations into the development process from the start. A pre-development compliance checklist - what are the likely applicable requirements for this type of system in these jurisdictions? - takes 30 minutes and can prevent months of rework.

Document as you go. The documentation required for high-risk AI systems under the EU AI Act - technical documentation, conformity assessments, post-market monitoring logs - is substantially easier to produce if it is created contemporaneously with development rather than reconstructed after the fact. Build documentation requirements into your AI development lifecycle, not your compliance response process.

The Vendor Compliance Dimension

If you procure AI from vendors, you share responsibility for compliance. The EU AI Act creates specific obligations for deployers (organizations using AI systems) as well as developers. Even if a vendor provides the AI system, the deployer is responsible for ensuring appropriate use, human oversight, and - in some cases - conformity assessment.

Your vendor contracts should require: representation that the system is compliant with applicable AI regulations, provision of technical documentation sufficient for you to fulfill your deployer obligations, notification of material changes to the system, and cooperation with your audit and compliance activities.

Do not assume your vendor's compliance covers your compliance. In most regulatory frameworks, they do not.

Key Takeaways

• AI regulation is multi-layered and jurisdiction-specific. Applicable rules depend on where you operate, what sectors you are in, and what your AI systems do. There is no single global framework.
  - The EU AI Act's risk-based classification is the most influential framework to date. High-risk classification triggers extensive requirements; minimal risk triggers voluntary-only obligations.
  - Start with an inventory. You cannot manage what you have not catalogued. Include AI embedded in commercial software, not just systems your team built.
  - Build a compliance matrix. Map systems to requirements to current status. Make the gaps visible before they become incidents.
  - Compliance built into development costs far less than compliance bolted on afterward. A pre-development checklist prevents months of rework.
  - Vendor compliance does not substitute for deployer compliance. Know your obligations as a deployer and ensure vendor contracts support your ability to meet them.
  - The regulatory landscape will keep moving. Build regulatory monitoring into your routine processes, not your emergency response.