Glossary
Updated
What does AI compliance cover?
AI compliance is the part of governance that answers to someone outside the organization: a regulator, an auditor, a customer or a court. It covers laws written for AI, such as the EU AI Act, and older laws that apply to AI use, such as data protection, consumer protection, employment and anti-discrimination law. It also covers standards a company chooses to follow or certify against, and the terms customers write into contracts.
Which rules apply to most enterprises?
It depends on where you operate and what the AI does. In the EU, the AI Act's bans and AI literacy duty have applied since February 2, 2025, its transparency duties under Article 50 since August 2, 2026, and its high-risk duties for uses listed in Annex III apply from December 2, 2027. The GDPR applies whenever AI processes personal data.
In the US, no broad federal AI law has overridden the state laws, and states have moved. New York City's Local Law 144 requires bias audits of AI hiring tools, Texas's TRAIGA is in force, and Colorado's SB 26-189 applies from January 1, 2027. Banks also face sector guidance, such as SR 26-2 in the US and PRA SS1/23 in the UK.
Standards such as ISO/IEC 42001 and the NIST AI RMF are voluntary, but they can still count. Texas's TRAIGA treats substantial compliance with NIST's Generative AI Profile as one condition for avoiding liability. Our guide to US state AI laws covers the state rules in detail.
How is compliance different from governance?
AI governance is how an organization decides which AI to use and on what conditions. Compliance is one input to those decisions and one result of them. A system can be legally compliant and still be a bad idea. A strong governance process also makes compliance easier, because the evidence a regulator asks for is created as decisions are made, not rebuilt afterward.
How do you show compliance?
Regulators and auditors ask for evidence. For each AI system that usually means four things: a record of what it is and who owns it, a classification that shows which rules apply, the controls each rule requires with an owner and evidence for each, and a sign-off showing someone reviewed the result. The same evidence often satisfies several regimes, so mapping controls across frameworks saves doing the work twice. A compliance framework turns each law or standard into a list of controls you can assign.
In Enzai, you run a framework such as the EU AI Act or ISO 42001 as an assessment on each AI system. How you classify the system decides which controls appear, and each control gets an owner, a due date and evidence before the assessment is complete. You can build your own framework for any law without a ready-made one. Your auditors and regulators judge compliance; Enzai keeps the record. See AI risk and compliance.
Example
An insurer that sells health cover in Ireland and in Colorado uses a vendor's model to help set prices. In Ireland it deploys a high-risk system under Annex III of the EU AI Act, so before December 2, 2027, it plans trained human oversight, log keeping and a fundamental rights impact assessment. In Colorado, insurance decisions fall under SB 26-189 from January 1, 2027, so its counsel sets out the notices and records that law needs. The insurer keeps both sets of duties in one control list, with an owner and evidence for each, so a reviewer can see every obligation for the model in one place.