What is AI compliance?
AI compliance means making sure an organisation's use of AI meets the relevant laws, regulations and standards, such as the GDPR and the EU AI Act. It covers data protection, transparency, fairness, documentation and risk controls.
AI compliance is showing that your AI use meets the GDPR, the EU AI Act and, if you choose, ISO 42001.
AI compliance means making sure an organisation's use of AI meets the relevant laws, regulations and standards, such as the GDPR and the EU AI Act. It covers data protection, transparency, fairness, documentation and risk controls. Building compliance in from the start avoids fines and reputational damage, and is far less expensive than fixing systems after a regulator or customer raises concerns.
AI compliance is being able to show that the way your organisation builds and uses AI meets the rules that apply to it: the GDPR for the personal data, the EU AI Act for the AI system itself, and, where you choose to adopt one, a management-system standard such as ISO/IEC 42001.
The three are usually explained one at a time. In practice they ask for overlapping evidence about the same systems, so the efficient route is one checklist per AI system, with one owner, rather than three separate projects run by three departments.
The three rule sets, and what each one asks for
| Rule set | Binding? | What it asks for, in short |
|---|---|---|
| GDPR (AVG) | Yes, whenever personal data is processed | A lawful basis, a processor agreement with each supplier, a DPIA where the processing is likely to be high-risk (Article 35), and records of processing |
| EU AI Act | Yes, for providers and deployers of AI systems | Your role and the risk class per system, measures to support staff AI literacy (Article 4), transparency where people interact with AI (Article 50), and the high-risk requirements where they apply |
| ISO/IEC 42001 | No, voluntary and certifiable | An AI management system: policy, roles, risk assessment and continual improvement, built the same way as an ISO 27001 ISMS |
The dates that matter in 2026 and after
The AI-literacy duty and the prohibitions have applied since 2 February 2025, and enforcement of them started on 2 August 2026, the same date the Article 50 transparency rules began to apply. After the Digital Omnibus (Regulation (EU) 2026/1744) the high-risk requirements for Annex III systems apply from 2 December 2027 and those for AI embedded in Annex I products from 2 August 2028. Source: the European Commission's AI Act timeline. For most companies that use AI rather than sell it, the duties that bite now are literacy, transparency and the GDPR, not the high-risk regime.
One checklist per AI system
For every AI system in use, keep one line that answers seven questions: what it does and for whom; whether you are the provider or the deployer; its AI Act risk class; the personal data it touches and the GDPR basis; whether a DPIA was needed and where it is; who in the organisation owns it; and when it was last evaluated. That line is your AI register entry, and it is the first thing an auditor, a supervisor or a customer's procurement team will ask for. Most of the work is finding the systems, including the subscriptions bought on departmental cards.
Who signs what off
Compliance fails when it belongs to nobody. A workable split in an organisation with its own IT function: the business owner of each system answers for what it does and signs its register line; the privacy officer or DPO signs the GDPR basis and the DPIA; IT or the ICT partner supplies the hosting, access and logging facts; and one person, often in risk, legal or the CISO's team, owns the register and the review cycle. The supplier that built the system, us included, supplies the system description and the evaluation evidence but cannot sign for you.
Where to start
Start with the inventory, not the policy. A policy written before you know which systems you run describes systems nobody has listed. Our AI Act check does that inventory for a fixed €950 within a week: every system with its role and risk class, a usage-policy template and a to-do list. If you already run an ISO 27001 ISMS, ISO 42001 can reuse much of it; see ISO 42001 next to ISO 27001. How the documents fit together is set out under AI governance.
Frequently asked questions
Is AI compliance the same as AI governance?
No. Compliance is meeting the rules that bind you; governance is the internal practice that produces the evidence: the register, the owners, the review cycle.
- Good governance makes compliance less expensive, because the evidence already exists when someone asks.
- Governance also covers systems no regulation reaches.
Is ISO 42001 required under the AI Act?
No. ISO/IEC 42001 is a voluntary, certifiable standard for an AI management system. It can help structure the evidence the AI Act and the GDPR ask for, and some customers ask for it in procurement, but no law requires it.
Does AI compliance apply if we only use tools such as ChatGPT or Copilot?
Yes, as a deployer. You still need measures for staff AI literacy, rules on which data may go into which tool, a processor agreement for personal data, and transparency where customers interact with the AI. The provider's duties sit with the vendor; yours sit with you.
Want this applied in your business? See how we take it to production:
From concept to working tool?
We build this AI in production, at fixed prices, with one named expert. Start with a free consultation.
Book a free consultation →