AI Regulatory & Compliance Center
Plain-language summaries, compliance checklists, and deadline tracking for the major AI regulatory frameworks. EU AI Act, HIPAA, GDPR, and NIST AI RMF — all in one place.
This page provides general educational information only. It does not constitute legal advice. Consult qualified legal counsel for compliance obligations specific to your organization.
Regulation Navigator
Select a framework to review requirements, key dates, and official sources
European Union Artificial Intelligence Act
The EU AI Act establishes a risk-based framework for AI systems affecting EU residents. High-risk categories (hiring, credit scoring, medical devices, biometrics, critical infrastructure) face strict conformity requirements before deployment. Prohibited uses include social scoring and real-time biometric identification in public spaces.
Key Requirements
- Risk classification: categorize all AI systems as prohibited, high-risk, limited-risk, or minimal-risk
- High-risk AI: conformity assessments required before deployment
- Human oversight: override mechanisms mandatory for high-risk applications
- Transparency: disclose when users interact with AI systems
- Incident reporting: serious incidents must be reported within 72 hours
- Prohibited AI: social scoring and real-time public biometrics are banned
Enterprise Impact: High — most enterprise AI deployments fall in scope
Self-Assessment Checklists
Use these to identify gaps. Not a substitute for legal advice — but a good starting point for scoping compliance work.
Which framework applies to you?
Most organisations deal with more than one. As a rough guide to where each applies:
- EU AI Act: AI systems placed on the EU market or used to make decisions about people in the EU, including systems built by US and Australian companies.
- HIPAA: protected health information handled by US healthcare providers, health plans and clearinghouses, and by the vendors that work for them.
- GDPR: personal data about people in the EU and EEA, including data used to train, test or run AI systems.
- NIST AI RMF: a voluntary US framework for managing AI risk, often used as the structure for an internal AI governance programme.
What does a compliance gap analysis include?
We start with an inventory of the AI systems you run or plan to run and the data each one touches. Each system is mapped against the frameworks that apply, gaps are listed in order of risk, and you get a remediation roadmap you can act on. Because we are engineers, we can also build the fixes: audit logging, role-based access control, human override steps, encryption and the documentation an auditor will ask for.
How do you build compliance into delivery?
Compliance is part of the build, not a review at the end. Our delivery process is built to SOC 2 standards, we can sign a BAA for HIPAA work, and systems we hand over include AES-256 encryption, role-based access and audit trails. When data cannot leave your premises, AsymiLink AI runs on your own hardware.
Is this page legal advice?
No. The summaries and checklists here are general information to help you scope the work. Your obligations depend on your organisation, so we work alongside your legal counsel rather than in place of them.