AI Compliance: Key Risks, Frameworks, and How to Comply

AI compliance means two things: the ongoing work to ensure the AI systems your organization builds or uses meet applicable laws, standards, and internal policies, and using AI for routine, high-volume compliance work.

This article covers both meanings: the risks AI compliance addresses, the main frameworks, how to build a compliance program, controls for AI agents, and where AI helps compliance teams. It closes with questions to ask before buying a compliance tool.

What is AI compliance?

AI compliance refers to two things: making AI systems meet the rules laid out in AI regulation, and using AI to do compliance work.

In the first sense, AI compliance ensures an AI system follows the laws, regulations, ethical standards, and internal policies across the AI lifecycle, from training data to performance and usage.

For example, New York City’s Local Law 144 requires employers using an automated employment decision tool to have it bias-audited within one year of use, make information about the audit public, and notify employees or job candidates.

AI regulatory compliance work is ongoing because AI applications get updated, the data they work with changes, and regulations evolve.

In the second sense, compliance teams use AI for routine, high-volume work such as monitoring transactions, reviewing documents, and tracking regulatory changes.

Some financial institutions, for instance, use AI to review transactions and cut false positives in transaction-monitoring alerts before analysts decide which ones need a suspicious activity report.

AI compliance vs. AI governance vs. AI risk management

The three terms overlap but cover different ground: Governance sets the rules, risk management finds what could go wrong, and compliance ensures the rules are met.

Term

Scope

Typical owner

When it applies

AI governance

Policies, roles, and decision rights for how the organization builds and uses AI

Leadership or an AI governance committee

Continuously, starting with AI strategy

AI risk management

Finding, measuring, and reducing harms such as bias, data leaks, and errors

Risk and security teams, AI model owners

Before AI deployment and throughout use

AI compliance

Showing that AI systems meet laws, standards, and internal policies

Compliance, legal and privacy teams

Whenever a law, contract or standard covers the system

Why AI compliance is important

Achieving AI compliance limits your exposure to fines, safeguards the privacy of the people whose information your AI processes, and enables your organization to account for its use of AI systems in case of an audit.

• Regulatory penalties: Under the EU AI Act, using a banned AI practice, such as inferring employees’ emotions at work, can cost up to €35 million or 7% of worldwide annual turnover. Providers and deployers can face fines of up to €15 million or 3% for Act breaches.
• Data protection: An AI system that processes personal data is subject to data protection laws, such as the GDPR in the EU. This includes training data, prompts, and outputs containing personal data.
• Audit readiness: Records of which AI systems you use, who approved them, and how you monitor them let you answer to regulators, auditors, and customers.

The main risks AI compliance addresses

AI compliance addresses five main risks: algorithmic bias, lack of explainability, hallucinations in regulated processes, data privacy and leakage, and shadow AI.

Here are the manifestations of the main risks and examples of controls that keep them in check:

• Algorithmic bias: A model reproduces patterns in its training data that disadvantage certain groups. A hiring tool, for example, might rank candidates lower based on a proxy for age or ethnicity, such as graduation year or ZIP code. Bias audits, which compare outcomes across demographic groups, help detect these patterns.
• Lack of explainability: The organization can’t show how a model reached a decision. If a lender can’t explain why a model declined a loan, it can’t defend the outcome. Organizations prevent it by documenting model inputs and decision logic, and choosing models with traceable outputs.
• Hallucinations in regulated processes: A generative AI tool states something false with confidence. For instance, an attorney might ask an AI tool for case law supporting an argument and receive citations to court rulings that don’t exist. Requiring sources for every output, and having a qualified person verify them, catches such errors.
• Data privacy and leakage: Confidential or customer information reaches a tool outside the organization’s control. For example, an employee might paste customer records into a public AI tool that retains inputs to train future models. Using only approved tools with contractual limits on training and data retention reduces the risk.
• Shadow AI: Employees use AI tools the organization hasn’t approved or can’t see. In a 2026 Compliance Week survey, 42% of participants reported unmanaged AI use by employees. Possible solutions include an approved-tool list combined with a fast AI tool approval process, and web gateways.

AI compliance draws on binding AI governance frameworks, such as the EU AI Act, and voluntary frameworks, such as the NIST AI Risk Management Framework and ISO/IEC 42001, which help organizations meet them.

EU AI Act

The takes a risk-based approach to AI regulation: some practices are banned outright, high-risk systems face tight restrictions, while others only have light transparency rules. It applies to providers and deployers everywhere “where the output produced by the AI system is used in the Union.”

The obligations under the EU AI Act depend on an organization’s role:

• Those that develop a high-risk AI system or market it under their own name (providers) must complete a conformity assessment, apply the CE marking, register the system, keep technical documentation, and monitor it after release.
• Those who use a system someone else built (deployers) must follow the provider’s instructions, assign oversight to people with “the necessary competence, training and authority,” keep logs for at least six months, and inform workers and others affected by its decisions.

The Act is being rolled out in stages. Banned practices, AI literacy, and general-purpose AI rules have applied since 2025, while high-risk obligations start on December 2, 2027, and on August 2, 2028, for AI built into products covered by EU product-safety law.

EN 18286:2026 on quality management systems is the first European standard that supports the Act. Providers that follow it are presumed to meet the Act’s quality management requirement.

NIST AI Risk Management Framework

The NIST AI RMF (Risk Management Framework), published in January 2023, is a voluntary US framework built around four functions: Govern, Map, Measure, and Manage.

Its Generative AI Profile, released in July 2024, applies the framework to generative AI risks.

ISO/IEC 42001

ISO/IEC 42001 is the international standard for AI management systems and covers the policies, roles, and processes that govern responsible AI development and use. Certification is voluntary and comes from independent certification bodies, not ISO itself.

A certificate covers the organization’s management system, not a specific AI product.

US and sector rules that apply to AI

The US has no single federal AI law. Rules come from cities, states, and existing laws and regulations that apply to AI.

For example, Colorado’s SB26-189, which comes into force on January 1, 2027, regulates automated decision-making technology, and privacy laws, such as the California Consumer Privacy Act (CCPA) or HIPAA, apply whenever AI processes protected data.

How to build an AI compliance program

Building an AI compliance program involves six steps: inventory your AI systems, classify them by risk, map controls to the rules that apply, assign owners, document each system, and monitor it with records an auditor can check.

Each step below ends with the record it produces:

• Inventory every AI system. List the systems your organization builds, buys, or uses, including AI features inside existing software and tools employees adopted without approval. Record what each does, who uses it, and what data it touches.Output: An AI inventory.
• Classify each use case by risk. Rate each system by the harm it could cause, using a scheme such as the EU AI Act’s risk tiers. For instance, a tool that sets life insurance premiums is high-risk under the Act, while one that summarizes internal meetings isn’t.Output: A risk register.
• Map controls to the applicable rules. List the laws, standards, and internal policies that apply to each system, and the control that meets each compliance requirement. For instance, a documented human review helps satisfy the EU AI Act’s human oversight requirements for high-risk systems and the NIST AI RMF’s call for documented human oversight processes.Output: A control map.
• Assign owners and human oversight points. Name an owner for every system and decide where a person reviews its output. For instance, legal and compliance own the obligations, security owns the technical controls, business owners own their use cases, and one executive is accountable overall. Ensure people across the organization are aware and set up clear lines of communication.Output: Named owners for each system.
• Document each system. Record each system’s purpose, training data, testing, and known limitations in formats such as model cards and impact assessments. Providers of high-risk systems must also prepare the technical documentation in Annex IV of the EU AI Act.Output: A system documentation set.
• Monitor, log, and keep evidence. Design logs as audit evidence from the start to show what a system did and who reviewed it. The EU AI Act requires high-risk systems to record events automatically over their lifetime. An audit trail should capture:The model and version in useInputs and outputs, or a defined sample of themTraining or fine-tuning dataHuman review points and their outcomesActions an agent took and the permissions it usedHow long each record is kept
• The model and version in use
• Inputs and outputs, or a defined sample of them
• Training or fine-tuning data
• Human review points and their outcomes
• Actions an agent took and the permissions it used
• How long each record is kept

Output: Monitoring records and an audit trail.

Specialist AI compliance tools, such as IBM watsonx.governance and OneTrust AI Governance, can take over parts of this program, including the AI inventory, risk assessments against the EU AI Act, and documentation.

How to approve AI tools employees can use

Before approving an AI tool, check four things:

• Data access: Which files, systems, and connected knowledge bases the tool can read, and whether they hold personal data it could expose.
• Training on inputs: Whether the vendor uses prompts, files, or outputs to train its models, and whether your contract with the vendor prohibits it.
• Retention: How long the vendor keeps prompts, files, and conversation history, and whether you can shorten it.
• Hosting and transfers: Where the vendor stores and processes data, including transfers outside your region.

Compliance controls for AI agents

AI agents need more controls than chat tools because they decide their own steps and act through granted tools and permissions. Three controls keep them in check:

• Least-privilege access: Give an agent only the tools and permissions its task needs. Excessive Agency, where an agent can do more than its task requires, is one of the top security risks according to the OWASP Top 10 for LLM Applications 2026.
• A log of every action: Record each tool call, the data accessed, and the permissions used, to trace what an agent did and for whom.
• Human approval for high-impact actions: Require a person to confirm steps that send data outside the organization, move money, or can’t be undone.

How AI is used in compliance work

Compliance and risk management teams use AI to monitor controls, assess risk, track regulatory changes, review documents, and triage financial-crime alerts.

In a 2026 Compliance Week survey of 193 compliance, ethics, risk, and audit leaders, more than 83% said they use AI, and nearly 40% said their companies have deployed it for risk assessment and monitoring.

Common AI use cases in compliance include:

• Continuous compliance monitoring and evidence collection: AI runs checks and gathers proof they work (e.g., overdue equipment safety inspections at a plant).
• Risk assessment and prioritization: AI ranks business units or third parties by risk (e.g., suppliers with new sanctions or litigation exposure).
• Regulatory change monitoring: AI tracks regulator publications and summarizes changes (e.g., revised anti-bribery guidance that lowers the gift limit in the expenses policy).
• Document and policy review: AI compares contracts and policies against requirements (e.g., supplier contracts without a right-to-audit clause).
• Financial-crime screening: AI triages transaction-monitoring and customer-check alerts (e.g., sanctions-list name matches that turn out to be a different person).

AI used for compliance needs the same governance as other AI systems. As the UK's Financial Conduct Authority stated in October 2026, "firms are responsible for AI systems they develop, procure and deploy – including their outputs and outcomes" and warned not to make the human review “a ‘box-ticking’ exercise".

In practice, AI tools may handle routine tasks like evidence gathering or flagging regulatory changes, but not decisions that carry legal responsibility, like deciding whether to report suspicious activity or how to design policies.

Data controls in Perplexity Enterprise

Perplexity Enterprise gives administrators the controls covering training on inputs, data access, and retention:

• No training on your data: Perplexity never uses enterprise content to train its AI models, and its agreements with third-party model providers prohibit them from training on it.
• Access control: SSO, SCIM, and role-based permissions set who can upload files and share answers.
• Retention and audit logs: Files attached to sessions are deleted after seven days. Organizations with 50 or more seats, or at least one Enterprise Max seat, can also set session retention and receive audit logs of user activity.
• Certifications: Perplexity is SOC 2 Type II certified, complies with GDPR, and allows work with protected health information only under a signed Business Associate Agreement.

For a walkthrough of these controls, contact our Sales team to book a personalized demo.

Frequently asked questions

What is EU AI compliance?

EU AI compliance means meeting the EU AI Act’s obligations for your role (provider or deployer) and for each system’s risk tier. The obligations apply in stages, with high-risk duties starting on December 2, 2027.

What is a HIPAA-compliant AI?

A HIPAA-compliant AI is a tool used within HIPAA’s safeguards for protected health information. If the vendor stores or processes that information, the US Department of Health and Human Services requires a signed Business Associate Agreement first.

Does the EU AI Act apply to US companies?

Yes. The AI Act covers US companies that place AI systems on the EU market and those whose AI output is used in the EU.

Can AI replace compliance officers?

AI can't replace compliance officers. Organizations are responsible for their work, and AI technologies may make errors, so compliance officers still need to scrutinize and approve AI outputs.