AI Regulations and Governance Frameworks

In December 2023 the US Federal Trade Commission banned Rite Aid from using facial recognition for five years. The pharmacy chain had run a system in hundreds of stores that matched shoppers against a database of suspected shoplifters. The FTC's complaint described thousands of false matches: employees stopped, searched, publicly accused and ejected customers on the strength of them, including children. The system had been fed low-resolution CCTV stills and photographs from mobile phones, was never tested for accuracy, was never monitored after deployment, and generated matches at higher rates in stores located in areas with larger non-white populations.

There was no AI statute to break. The FTC used Section 5 of the FTC Act, which prohibits unfair or deceptive practices and was enacted in 1914. The order required Rite Aid to delete the data, delete models derived from it, and stand up a comprehensive algorithmic-fairness programme with independent assessments.

Two lessons sit inside that. First, "there is no AI law here" has never meant "there is no law here" — consumer protection, anti-discrimination, product safety and data protection statutes already apply to whatever you build. Second, when regulators do act, the remedy is increasingly the deletion of the model itself, which is a materially different cost from a fine.

What regulation is actually trying to fix

Regulation exists where markets reliably fail. Three specific failures show up with AI systems.

A human loan officer with a prejudice harms hundreds of people over a career and can be individually challenged. A model with the same prejudice harms millions and cannot be deposed. That asymmetry of scale is the core regulatory argument, and it explains why the rules focus on documentation, testing and human oversight rather than on banning techniques.

The global picture in one table

Two structural points matter more than any individual rule. Extraterritoriality: the EU AI Act binds providers outside the EU if the system is placed on the EU market or if its output is used in the EU. A model served from Bengaluru or California to an EU employer is in scope. And the Brussels effect: because building two versions of a product is expensive, the strictest applicable regime tends to become the global default. Plan for the strictest regime you touch.

The EU AI Act, in the detail you need

It regulates uses, not techniques

The Act almost never asks what algorithm you used. It asks what the system decides and about whom. The same gradient-boosted classifier is unregulated when it routes warehouse pallets and high-risk when it ranks job applicants. This is why "we only use simple logistic regression" is not a defence, and why a risk classification cannot be done by the ML team alone — it depends on the deployment context.

The four tiers

Unacceptable risk — prohibited outright (Article 5, applicable since 2 February 2025):

• Subliminal, manipulative or deceptive techniques that materially distort behaviour and cause significant harm
• Exploiting vulnerabilities of age, disability or socio-economic situation
• Social scoring by public or private actors leading to detrimental treatment in unrelated contexts or disproportionate to the behaviour
• Predicting criminal offending based solely on profiling or personality traits
• Untargeted scraping of facial images from the internet or CCTV to build recognition databases — the practice at issue in the Clearview AI enforcement actions
• Emotion inference in workplaces and educational institutions, outside medical and safety uses
• Biometric categorisation inferring race, political opinions, trade union membership, religion, sex life or sexual orientation
• Real-time remote biometric identification in public spaces for law enforcement, with narrow exceptions that need prior judicial or independent authorisation
• Added in 2026 by the Digital Omnibus: systems that generate non-consensual intimate imagery or child sexual abuse material ("nudification" apps), with its own, later start date

High risk — permitted but heavily regulated. Two routes in. Annex I: the system is a safety component of a product already regulated under EU product legislation (medical devices, machinery, lifts, vehicles, toys). Annex III: the system operates in one of eight listed areas — biometrics; critical infrastructure; education and vocational training; employment and worker management; access to essential public and private services including creditworthiness and life or health insurance pricing; law enforcement; migration and border control; administration of justice and democratic processes.

When high-risk duties start. The original dates were August 2026 for Annex III and August 2027 for Annex I. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) moved them to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. These dates have already moved once, so check the current text before you plan a roadmap around them — but treat the delay as time to build, not as a reprieve: the core obligations in the table below are largely unchanged.

Article 6(3) provides an escape hatch that is easy to over-claim. An Annex III system is not high risk if it only performs a narrow procedural task, improves the result of a previously completed human activity, detects decision patterns without replacing human assessment, or performs a preparatory task. But the exemption never applies if the system profiles natural persons. A CV parser that merely extracts fields into a form may qualify; a CV parser that scores candidates does not.

Limited risk — transparency only (Article 50, applicable from 2 August 2026): tell people when they are interacting with an AI system; mark synthetic audio, image, video and text in a machine-readable way; disclose deepfakes; disclose emotion recognition and biometric categorisation to the people subjected to them. Generative systems already on the market before that date got a short grace period, to 2 December 2026, for the machine-readable marking.

Minimal risk — spam filters, recommendation engines for products, game AI. No AI-Act-specific obligations, though other law still applies.

What "high risk" actually costs you

Note Article 10(5) carefully. It resolves the tension where privacy rules push you to delete demographic data and fairness testing requires it. The law's answer is that you may collect and process it for the specific purpose of bias detection and correction, under safeguards. "We deleted ethnicity for GDPR reasons so we cannot test for discrimination" is not a defence under this regime. The 2026 Omnibus amendments widened the permission to cover bias detection in AI systems that are not high risk too, still under safeguards.

General-purpose models

Chapter V, applicable from 2 August 2025, covers foundation models separately from applications built on them. All providers of general-purpose AI models owe: technical documentation, information to downstream providers so they can meet their own obligations, a copyright compliance policy, and a sufficiently detailed public summary of training content. Models presenting systemic risk — presumed above a cumulative training compute of $10^{25}$ floating point operations — additionally owe model evaluation including adversarial testing, systemic risk assessment and mitigation, incident reporting, and cybersecurity protection.

Penalties

For SMEs and start-ups the cap is the lower of the two figures. Seven percent of global turnover exceeds the GDPR's headline 4%, which tells you how the legislature ranked the risk.

A working classifier

1def eu_ai_act_tier(system):2    """Rough triage. Produces a starting point for legal review, not a legal opinion."""3    if system.practice in PROHIBITED_PRACTICES:            # Article 5 list4        return "PROHIBITED"56    annex_iii = system.domain in {7        "biometrics", "critical_infrastructure", "education",8        "employment", "essential_services", "law_enforcement",9        "migration_border", "justice_democracy",10    }11    annex_i = system.is_safety_component_of_regulated_product1213    if annex_i or annex_iii:14        narrow = system.only_narrow_procedural_task or system.only_preparatory_task15        # the escape hatch never applies to profiling of natural persons16        if annex_iii and narrow and not system.profiles_natural_persons:17            return "NOT HIGH RISK (Art 6(3)) - document the reasoning"18        return "HIGH RISK"1920    if system.interacts_with_humans or system.generates_synthetic_content:21        return "LIMITED RISK - transparency duties (Art 50)"2223    return "MINIMAL RISK"

The failure mode here is teams self-classifying out of high risk by asserting "a human makes the final decision". That is not what Article 6(3) says. If the system scores, ranks or profiles people, a human rubber-stamping the ranking does not lift it out of the tier — and the human-oversight requirement in Article 14 exists precisely because rubber-stamping is the expected human behaviour.

Risk tier is determined by what the system decides and about whom, never by which model architecture you chose.

The United States: no single law, plenty of liability

There is no comprehensive federal AI statute. Existing regulators apply existing powers, and the states have moved faster than Congress. Federal policy has also turned against state AI laws: a December 2025 executive order set up a Justice Department task force to challenge ones it considers burdensome. The state rows below are the most volatile part of this table, so check their current status before relying on them.

The strategically important entry is algorithmic disgorgement. A fine is a cost of doing business; an order to delete a model trained on improperly obtained data destroys the asset. Any data-sourcing shortcut that would be embarrassing to explain should be read as a bet on the continued existence of the model that depends on it.

NIST AI RMF: the framework that fills the gap

Laws tell you what outcome is required. They do not tell you how to organise the work. The NIST AI Risk Management Framework 1.0, published January 2023, is voluntary, sector-neutral, and has become the default vocabulary in US practice — including in contracts, where "aligned to NIST AI RMF" is now a common procurement clause.

It defines seven characteristics of trustworthy AI: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair with harmful bias managed. Then four functions, which run continuously rather than in sequence.

GOVERN is drawn as surrounding the other three because it is the one that fails silently. MAP, MEASURE and MANAGE all produce visible outputs; GOVERN produces the authority to act on them. A team can measure a serious disparity and ship anyway if no one is empowered to say no.

The question that reveals whether governance is real: who, by name, can stop a launch — and have they ever done it?

NIST added a Generative AI Profile (AI 600-1) in July 2024. It lists twelve risks that generative AI creates or makes worse — among them confabulation, CBRN information, data privacy, information integrity, information security, harmful bias and homogenisation, and value-chain and component integration — and maps suggested actions onto the four functions. NIST has said AI RMF 1.0 is being revised under the 2025 White House AI Action Plan, so check which version a contract or procurement clause refers to.

ISO/IEC 42001 and the OECD principles

ISO/IEC 42001:2023 is the first certifiable AI management system standard. Structurally it is the familiar Plan-Do-Check-Act management system — the same shape as ISO 27001 for information security — with an annex of AI-specific controls covering impact assessment, data management, lifecycle documentation and third-party responsibilities. The practical difference from NIST is auditability: an accredited body can certify you against 42001, and certification is a document you can put in a procurement response. It says your process is sound. It does not say any individual model is fair.

The OECD AI Principles (2019, updated 2024) are soft law with unusual reach: adopted by around fifty countries, they supplied the definition of "AI system" that flowed into the EU AI Act and much national legislation, and they underpin the G7 Hiroshima process. Five principles: inclusive growth and well-being; human rights and democratic values including fairness and privacy; transparency and explainability; robustness, security and safety; accountability. Their function is convergence — they are why the world's AI laws rhyme.

They are complements, not alternatives. A common working pattern is to use NIST AI RMF as the internal operating model, ISO 42001 as the audited wrapper, and the AI Act as the list of hard requirements each high-risk system must satisfy.

Standing up a governance programme

Six components, in the order that they actually pay off:

1. Inventory. You cannot govern systems you cannot list. Most organisations discover on first pass that they have several times more models in production than anyone believed, including spreadsheets, vendor features enabled by default, and scripts owned by people who have left.
2. Risk tiering. Apply one classification rubric to the whole inventory. Nearly everything will land in the lowest tier, which is the point: it concentrates scarce review capacity on the small number of systems that decide something about a person.
3. Intake and gating. A lightweight form at project start capturing purpose, data, affected people and tier. High-tier systems get a defined review before launch, with a named approver.
4. Documentation standard. One model card template, one dataset datasheet template, stored in a registry rather than in a slide deck. Include intended use and out-of-scope uses; the second field is the one that protects you when the model is repurposed two years later.
5. Monitoring and incident response. Per-group metric alerting, a defined severity scale, a rollback procedure that has been tested, and a route for affected people to complain that reaches an engineer.
6. Third-party assessment. Most AI risk now arrives through a vendor. Ask for the model card, the per-group evaluation results, the training data provenance, the incident history, and the contractual right to audit. "It's a vendor model" transfers none of your legal obligation as a deployer.

What this means for the system you are building

Classify before you build, not before you launch. The high-risk obligations — data governance records, the Annex IV technical file, lifetime logging, designed-in human oversight — are architectural. Logging that can reconstruct an individual decision two years later is a data model decision; retrofitting it after launch means a migration. Teams that classify at the end discover that compliance requires rebuilding, and rebuilding is when deadlines get met by quietly reclassifying instead.

Write the out-of-scope uses down and mean them. The single most common path from a fine system to a harmful one is repurposing: a tool built to prioritise outreach becomes a tool that denies service, with no revalidation because it is "the same model". A documented, specific out-of-scope statement is what lets someone inside the organisation object with authority.

Assume the strictest regime you touch. If you serve EU users and NYC job applicants, you owe an Annex IV technical file and an annual published bias audit, and the underlying work overlaps heavily. Build the per-group evaluation once, in a reproducible pipeline, and emit both artefacts from it.

Finally, treat the model-deletion remedy as a design constraint on data sourcing. Fines are survivable and insurable. An order to delete a model and everything trained on it is not. Every scraped dataset and every repurposed consent is a bet that no regulator will ever ask where the data came from — and the record of the last few years is that they ask.