AI compliance covers the rules for building, selling and using AI systems: what is banned, what counts as high risk, what you must disclose, and how you manage AI risk inside the company. The EU AI Act is the main law, with phased dates running to 2028. ISO/IEC 42001 is the certifiable management standard, and NIST AI RMF is a voluntary framework widely used in the US.
5 items in this category
1 related from other categories
Oct 30, 2026 statuses last checked
At a glance
AI governance and compliance compliance compared
How the items in this category differ on the question that matters first: do you have to, or do you choose to?
Name
Type
Mandatory or voluntary
Where it applies
Current version
EU AI Act
Regulation
Mandatory for regulated organizations in scope
EU, plus non-EU providers whose AI is placed on the EU market or used there
Prohibitions apply since 2 February 2025 and general-purpose AI model duties since 2 August 2025. After the Digital Omnibus amendment (Regulation 2026/1744), Annex III high-risk duties apply from 2 December 2027 and Annex I from 2 August 2028.
ISO 42001
Certifiable standard
Voluntary, with independent certification
Global
ISO/IEC 42001:2023.
NIST AI RMF
Framework
Voluntary framework, no official certificate
United States, used worldwide
AI RMF 1.0 (January 2023) and the Generative AI Profile NIST AI 600-1 (July 2024).
OWASP Top 10 for LLMs
Guidance
Voluntary guidance, no official certificate
Global
The 2025 edition.
Colorado AI Act
Law
Mandatory by law for organizations in scope
Colorado, United States
SB 26-189, signed 14 May 2026, takes effect on 1 January 2027. A legal challenge was expected, so the guide is re-checked before launch.
Directory
What each one covers and who needs it
Regulation EU, plus non-EU providers whose AI is placed on the EU market or used there
EU AI Act
Artificial Intelligence Act, Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744
The EU AI Act regulates AI by risk. A short list of practices is banned. High-risk systems, such as AI used in hiring, education, credit scoring or critical infrastructure, need risk management, data governance, documentation, logging, human oversight, accuracy and robustness, plus conformity assessment. Chatbots and generative AI carry transparency duties, and general-purpose AI model providers have their own obligations. It binds providers and deployers, including non-EU companies. The top fines reach 35 million euros or 7% of turnover.
What it covers, who needs it and why
What it covers
AI systems and general-purpose AI models placed on the EU market or used in the EU, across their lifecycle.
Who needs it
Companies that build AI features, sell AI products into the EU, or use high-risk AI in the EU, including HR tech, edtech and fintech vendors.
Why it matters
It is the first comprehensive AI law, its phased dates are already running, and customers now ask vendors about AI Act roles and duties.
Key objectives
Ban unacceptable AI practices
Make high-risk AI safe and accountable
Give people transparency when AI is used
Govern general-purpose AI models
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
European Union; the AI Office and national market surveillance authorities
Current version
Prohibitions apply since 2 February 2025 and general-purpose AI model duties since 2 August 2025. After the Digital Omnibus amendment (Regulation 2026/1744), Annex III high-risk duties apply from 2 December 2027 and Annex I from 2 August 2028.
ISO/IEC 42001 is the first certifiable management system standard for artificial intelligence. It asks organizations that develop, provide or use AI to set an AI policy, assess AI risks and impacts on people, apply controls from its Annex A (such as data quality, transparency, human oversight and supplier management), and improve through audit and review. It uses the same structure as ISO 27001, so the two are often combined. Certification is voluntary and done by accredited bodies.
What it covers, who needs it and why
What it covers
Governance of AI across its lifecycle: policy, roles, risk and impact assessment, data, development, operation, monitoring and third parties.
Who needs it
AI product companies, SaaS vendors with AI features and enterprises that deploy AI and want auditable governance.
Why it matters
It gives customers independent proof of AI governance and supports readiness for laws such as the EU AI Act.
NIST AI 100-1, Artificial Intelligence Risk Management Framework, with the generative AI profile NIST AI 600-1
The NIST AI RMF is a voluntary framework for managing risks of AI systems to people, organizations and society. It describes characteristics of trustworthy AI (valid and reliable, safe, secure and resilient, accountable and transparent, explainable, privacy-enhanced, and fair) and four functions: Govern, Map, Measure and Manage. The Generative AI Profile adds risks and actions specific to generative models. It is widely referenced by US agencies, state laws and enterprise buyers.
What it covers, who needs it and why
What it covers
AI risk governance, context mapping, measurement and testing, and risk treatment across the AI lifecycle.
Who needs it
Organizations that build or deploy AI, especially those selling to US government or US enterprises.
Why it matters
It is the most common AI risk reference in the US and gives a practical structure that pairs with ISO 42001.
Key objectives
Build trustworthy AI
Manage AI risk across its lifecycle
Give a shared vocabulary for AI risk
Mandatory or voluntary
Voluntary framework, no official certificate.
Owner
NIST
Current version
AI RMF 1.0 (January 2023) and the Generative AI Profile NIST AI 600-1 (July 2024).
OWASP Top 10 for Large Language Model Applications
The OWASP Top 10 for LLM Applications lists the most critical security risks in applications built on large language models, starting with prompt injection and including sensitive information disclosure, supply chain risks, data and model poisoning, improper output handling, excessive agency and unbounded consumption. Like the web Top 10, it is an awareness document, not a certifiable standard. It is the practical checklist most security reviewers now use for chatbots, AI assistants and agents.
What it covers, who needs it and why
What it covers
Prompt handling, model and data supply chain, output handling, plugin and tool permissions, data leakage, system prompts, vector stores and resource abuse.
Who needs it
Teams building chatbots, AI assistants, agents and other LLM features, and the security teams that test them.
Why it matters
LLM features open new attack paths that traditional application security testing misses.
Colorado was the first US state to pass a broad AI law. In May 2026 it replaced its original act (SB 24-205) with SB 26-189, which takes a notice-based approach. Developers of automated decision-making technology used in consequential decisions, such as hiring, lending, housing or education, must give deployers technical documentation. Deployers must tell people when such a system is used, explain adverse outcomes, allow correction of data and offer human review. It takes effect on 1 January 2027.
What it covers, who needs it and why
What it covers
Automated decision-making technology used to make or substantially support consequential decisions about Colorado consumers.
Who needs it
Developers and deployers of AI or automated decision tools used in employment, education, lending, housing, insurance, healthcare and similar decisions.
Why it matters
It is a model other states are watching, and HR and edtech vendors must support their customers' notice and review duties.
Key objectives
Tell consumers when automated decisions affect them
Explain adverse decisions
Give a route to correction and human review
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
State of Colorado; enforced by the Attorney General
Current version
SB 26-189, signed 14 May 2026, takes effect on 1 January 2027. A legal challenge was expected, so the guide is re-checked before launch.
IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021
Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (India)
The IT Rules 2021 set due diligence duties that intermediaries must meet to keep safe harbor under Section 79 of the IT Act: publish rules and a privacy policy, act on takedown orders, appoint a grievance officer and resolve complaints within set times. Significant social media intermediaries have extra duties, including a chief compliance officer based in India. Amendments in 2026 require platforms to label AI-generated synthetic content and remove certain unlawful content much faster.
What it covers, who needs it and why
What it covers
Platforms, hosting providers, marketplaces, messaging and social media services, online gaming and digital news publishers.
Who needs it
Intermediaries serving users in India, from small hosting providers to large platforms, and companies offering generative AI features to Indian users.
Why it matters
Losing safe harbor makes the platform liable for its users' content.
Key objectives
Accountable intermediaries
Fast grievance redress
Transparency about synthetic content
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
MeitY (Part II) and the Ministry of Information and Broadcasting (Part III)
Current version
Amended in 2022, 2023 and again in 2026 with duties to label synthetically generated (AI) content and shorter takedown timelines.
Train your team on ai governance and compliance requirements
Most of these frameworks expect trained staff and records to prove it. LMS Advisor assigns the right courses by role, sends reminders, renews certificates on schedule and keeps an audit trail you can export.
Due dates, reminders and overdue reports for mandatory courses
Certificates that expire and renew on your retraining cycle
CSV, Excel and PDF exports of who completed what, and when
LMS Advisor is our product. It runs your training and keeps the records. It does not certify you against any standard.
Book a demo before Dec 1, 2026 and your quote comes with 30% off your first year of LMS Advisor: courses, proctored exams, certificates and AI authoring in one platform, in our cloud or on your own server.
Offer ends Dec 1, 2026, 11:59 PM ET
Cloud or self-hosted, proctoring included
The discount is applied in your written quote
We use cookies to see how visitors use this site and to measure our ads. Choose Continue to allow them, or Reject to browse without them. Privacy policy
LMS Advisor AI
AI product consultant
You're chatting with an AI. Answers can be wrong, so please don't type personal data here. Privacy ·
