AI Regulation Compliance Roadmap

The AI Regulatory Landscape

AI regulation has accelerated dramatically since 2023. Organizations deploying AI systems now face overlapping obligations from multiple frameworks:

Regulation / Standard	Scope	Enforcer	Key Obligation
EU AI Act	AI systems placed in EU market	EU Member States	Risk-tiered requirements; bans high-risk use cases
GDPR / UK GDPR	Personal data processing	Data Protection Authorities	Lawful basis, data minimization, individual rights
ISO 42001:2023	AI management systems	Certification bodies (voluntary)	Documented AIMS with continual improvement
NIST AI RMF	US federal & voluntary	NIST (guidance only)	Govern, Map, Measure, Manage risk functions
AI Act (China)	Generative AI in China	CAC	Security assessments, content labeling

Most organizations must navigate at least GDPR + EU AI Act together. ISO 42001 provides the management system scaffold that makes compliance with both more tractable.

Part 1: EU AI Act Compliance

Risk Tier Classification

The EU AI Act classifies AI systems into four tiers. Your obligations are entirely determined by which tier your system falls into.

Tier	Description	Examples	Obligation
Unacceptable risk	Banned outright	Social scoring, subliminal manipulation, real-time biometric surveillance (mostly)	Do not deploy
High risk	Significant potential for harm	CV screening, credit scoring, medical diagnosis, law enforcement	Full conformity assessment + registration
Limited risk	Transparency obligations only	Chatbots, deepfakes, emotion recognition	Disclose AI involvement to users
Minimal risk	No specific requirements	Spam filters, game AI, recommendation systems	Voluntary codes of conduct

High-Risk System Requirements

If your system is high-risk, you must implement and document:

1. Risk management system — documented risk identification, analysis, and mitigation
2. Data governance — training data quality, bias assessment, data provenance
3. Technical documentation — system description, design choices, architecture, performance metrics
4. Record-keeping — automatic logging sufficient to enable post-market monitoring
5. Transparency — user-facing information about capabilities and limitations
6. Human oversight — mechanisms for humans to monitor, override, or shut down
7. Accuracy, robustness, cybersecurity — documented performance benchmarks and testing

# Use this as a starting point — always consult legal counsel for final classification

EU_AI_ACT_CHECKLIST = {
    "unacceptable_risk_indicators": [
        "Real-time remote biometric identification in public spaces (law enforcement)",
        "Social scoring by public authorities",
        "Exploiting vulnerabilities of specific groups (age, disability)",
        "Subliminal manipulation techniques",
        "Predictive policing based solely on profiling",
    ],
    "high_risk_domains": [
        # Annex III categories
        "Biometric identification and categorization",
        "Critical infrastructure management (energy, water, transport)",
        "Education and vocational training (admissions, assessment)",
        "Employment and worker management (CV screening, performance monitoring)",
        "Access to essential private/public services (credit scoring, benefits)",
        "Law enforcement (evidence evaluation, risk assessment, profiling)",
        "Migration, asylum, border control",
        "Administration of justice",
    ],
    "limited_risk_triggers": [
        "System interacts with humans in real time (chatbot)",
        "Generates synthetic content (deepfakes, text, images)",
        "Performs emotion recognition",
        "Conducts biometric categorization",
    ],
}

def classify_system(domain: str, interacts_with_humans: bool, generates_synthetic: bool) -> str:
    if any(domain in ind for ind in EU_AI_ACT_CHECKLIST["unacceptable_risk_indicators"]):
        return "UNACCEPTABLE — do not deploy"
    if any(domain in d for d in EU_AI_ACT_CHECKLIST["high_risk_domains"]):
        return "HIGH RISK — full conformity assessment required"
    if interacts_with_humans or generates_synthetic:
        return "LIMITED RISK — transparency obligations apply"
    return "MINIMAL RISK — voluntary codes of conduct"

Part 2: GDPR Compliance for ML Pipelines

GDPR applies whenever your ML system processes personal data of EU residents. For ML, this creates obligations at every stage of the pipeline.

Lawful Basis for Training Data

Every personal data processing activity needs a lawful basis:

Basis	When Applicable	ML Example
Consent	Individual agreed explicitly	User opted in to personalization
Legitimate interests	Balancing test passes	Fraud detection on transaction data
Contract	Necessary to perform a contract	Credit risk for loan applications
Legal obligation	Required by law	AML transaction monitoring
Vital interests	Life-threatening situations	Rare
Public task	Public authority function	Government AI systems

Key Technical Obligations

Data minimization: collect only what you need for the stated purpose. Don't retain raw features after deriving aggregate statistics.

Purpose limitation: data collected for one purpose cannot be repurposed for another without fresh lawful basis. A model trained on customer service transcripts cannot be used for employee performance monitoring.

Right to erasure ("right to be forgotten"): when a user exercises this right, you must remove their data from training sets and retrain or use machine unlearning techniques.

Automated decision-making (Article 22): decisions that produce legal or similarly significant effects and are based solely on automated processing require:

• Explicit consent or legal basis
• Right to human review
• Right to contest the decision

from dataclasses import dataclass, field
from datetime import date

@dataclass
class PersonalDataInventoryItem:
    """Record of Processing Activities (RoPA) entry for an ML dataset."""
    dataset_name: str
    purpose: str
    lawful_basis: str
    data_categories: list[str]
    data_subjects: str
    retention_period_days: int
    third_country_transfers: bool
    security_measures: list[str]
    dpia_required: bool
    dpia_date: date | None = None
    erasure_procedure: str = ""

# Example: fraud detection model training data
fraud_training_data = PersonalDataInventoryItem(
    dataset_name="transaction_features_2023",
    purpose="Train fraud detection classifier for real-time transaction scoring",
    lawful_basis="Legitimate interests (fraud prevention)",
    data_categories=["Transaction amounts", "Merchant categories", "Timestamps", "Device fingerprints"],
    data_subjects="Account holders who transacted in 2023",
    retention_period_days=365 * 2,
    third_country_transfers=False,
    security_measures=["Encryption at rest (AES-256)", "Access logging", "Role-based access control", "Pseudonymization of direct identifiers"],
    dpia_required=True,  # Systematic processing at scale = DPIA required
    dpia_date=date(2024, 1, 15),
    erasure_procedure="Remove user from training set and trigger model retraining within 30 days of verified erasure request",
)

def check_dpia_required(item: PersonalDataInventoryItem) -> list[str]:
    """Check against WP29 criteria for DPIA triggers."""
    triggers = []
    if "biometric" in " ".join(item.data_categories).lower():
        triggers.append("Special category data (biometric)")
    if item.retention_period_days > 365:
        triggers.append("Long retention period")
    if "systematic" in item.purpose.lower() or "large scale" in item.purpose.lower():
        triggers.append("Systematic/large-scale processing")
    return triggers

Part 3: ISO 42001 AI Management System

ISO 42001:2023 is the first international standard for AI management systems (AIMS). It follows the same high-level structure (HLS) as ISO 9001 and ISO 27001, making it easier to integrate with existing management systems.

The ISO 42001 Structure

Clause 4 — Context: identify internal/external issues, interested parties, and the scope of the AIMS

Clause 5 — Leadership: top management commitment, AI policy, roles and responsibilities

Clause 6 — Planning: AI risk and opportunity assessment, objectives and plans

Clause 7 — Support: resources, competence, awareness, communication, documented information

Clause 8 — Operation: AI system impact assessment, supply chain controls, deployment controls

Clause 9 — Performance evaluation: monitoring, measurement, internal audit, management review

Clause 10 — Improvement: nonconformity, corrective action, continual improvement

Annex A Controls (selected)

Control	Description
A.2.2	AI policy
A.3.2	Internal audit of AIMS
A.4.1	Objectives and risk management for AI
A.5.2	AI system impact assessment
A.6.1	Data acquisition and preparation controls
A.6.2	Data quality and provenance
A.7.3	Third-party AI system governance
A.8.4	Incident detection and response
A.9.1	Responsible use policy

from dataclasses import dataclass
from enum import Enum

class ComplianceStatus(Enum):
    COMPLIANT = "compliant"
    PARTIAL = "partial"
    GAP = "gap"
    NOT_APPLICABLE = "n/a"

@dataclass
class ControlAssessment:
    control_id: str
    title: str
    status: ComplianceStatus
    evidence: str
    gap_description: str
    owner: str
    target_date: str

ISO_42001_ASSESSMENT = [
    ControlAssessment(
        control_id="A.2.2",
        title="AI Policy",
        status=ComplianceStatus.PARTIAL,
        evidence="Draft AI ethics policy exists",
        gap_description="Policy not formally approved by board; not communicated to all staff",
        owner="Chief AI Officer",
        target_date="2024-Q2",
    ),
    ControlAssessment(
        control_id="A.5.2",
        title="AI System Impact Assessment",
        status=ComplianceStatus.GAP,
        evidence="No formal process exists",
        gap_description="Need to implement pre-deployment impact assessment for all AI systems",
        owner="AI Governance Team",
        target_date="2024-Q3",
    ),
    ControlAssessment(
        control_id="A.6.2",
        title="Data Quality and Provenance",
        status=ComplianceStatus.COMPLIANT,
        evidence="DVC pipeline with data validation; Great Expectations suite; lineage tracked in DataHub",
        gap_description="",
        owner="Data Engineering",
        target_date="",
    ),
]

def generate_gap_report(assessments: list[ControlAssessment]) -> dict:
    gaps = [a for a in assessments if a.status == ComplianceStatus.GAP]
    partials = [a for a in assessments if a.status == ComplianceStatus.PARTIAL]
    compliant = [a for a in assessments if a.status == ComplianceStatus.COMPLIANT]
    return {
        "total_controls": len(assessments),
        "compliant": len(compliant),
        "partial": len(partials),
        "gaps": len(gaps),
        "priority_actions": [{"id": a.control_id, "owner": a.owner, "due": a.target_date} for a in gaps],
    }

The Compliance Roadmap: Phase by Phase

Phase 1: Inventory and Classification (Weeks 1–4)

1. List all AI systems in production and development
2. Classify each against EU AI Act risk tiers
3. Identify personal data flows → determine GDPR applicability
4. Conduct ISO 42001 gap assessment using Annex A controls

Phase 2: Foundation (Months 2–3)

1. Draft and approve the AI Policy (ISO 42001 A.2.2)
2. Establish AI governance committee with defined roles
3. Complete Data Protection Impact Assessments (DPIAs) for high-risk systems
4. Implement Record of Processing Activities (RoPA) for all personal data
5. Create technical documentation templates for high-risk AI systems

Phase 3: Controls Implementation (Months 4–6)

1. Implement AI system impact assessment process (pre-deployment gate)
2. Deploy data quality and provenance controls (DVC + Great Expectations)
3. Establish human oversight mechanisms for high-risk systems
4. Implement incident detection and response procedures
5. Set up model monitoring and drift alerting (Chapter 7 of MLOps module)

Phase 4: Audit and Certification (Months 7–9)

1. Conduct internal audit against ISO 42001 and EU AI Act requirements
2. Remediate nonconformities
3. Management review — top-level sign-off on AIMS effectiveness
4. Engage certification body for Stage 1 (document review) and Stage 2 (on-site audit)
5. For EU AI Act high-risk systems: complete conformity assessment and register in EU database

Phase 5: Continual Improvement (Ongoing)

1. Quarterly management reviews
2. Annual surveillance audits (ISO 42001)
3. Monitor regulatory updates (EU AI Act implementing acts, delegated regulations)
4. Maintain compliance as systems are updated or new systems are deployed

Summary

1. EU AI Act uses a risk-tier framework: unacceptable (banned), high-risk (full conformity), limited (transparency), minimal (voluntary)
2. High-risk systems require: risk management, data governance, technical documentation, logging, human oversight, and conformity assessment
3. GDPR applies whenever personal data is processed — establish lawful basis, conduct DPIAs, support erasure rights, and document all processing in a RoPA
4. ISO 42001 provides the management system scaffold (clauses 4–10 + Annex A controls) that bridges strategy to operational compliance
5. A practical compliance roadmap runs five phases: Inventory → Foundation → Controls → Audit/Certification → Continual Improvement
6. The EU AI Act high-risk obligations apply from August 2026 — gap assessments and implementation should begin now

This chapter completes the Responsible AI module. The combination of fairness, transparency, accountability, safety, privacy, and regulatory compliance defines what it means to build AI responsibly in practice.