AI Compliance

AI compliance is the discipline of ensuring that an organization use of artificial intelligence conforms to all applicable legal, regulatory, and contractual requirements. It is not a single law or regulation but the intersection of multiple frameworks that govern how AI systems process data, make decisions, and interact with stakeholders.

For regulated organizations, AI compliance is an extension of existing compliance obligations. A healthcare organization that must comply with HIPAA must also ensure that its AI tools comply with HIPAA. A financial advisory firm subject to SEC regulations must ensure AI tools used for client analysis meet those same regulations. AI does not create an entirely new compliance regime — it adds new dimensions to existing ones.

However, AI also introduces compliance challenges that traditional regulations did not anticipate. AI tools may process data in ways that are not transparent. Models may produce outputs that are difficult to explain. Vendors may change data practices without notice. Emerging AI-specific regulations like the EU AI Act address some of these gaps, but the regulatory landscape is still evolving.

AI compliance requires organizations to understand their obligations, implement safeguards to meet them, and maintain documentation that demonstrates compliance to regulators, auditors, and stakeholders.

AI compliance obligations arise from multiple sources. Understanding the landscape helps organizations identify which requirements apply to their AI use.

HIPAA and Healthcare AI For healthcare organizations, HIPAA is the primary compliance framework. When AI tools process protected health information, they must comply with HIPAA Privacy and Security Rules. This requires Business Associate Agreements with AI vendors, safeguards equivalent to HIPAA Security Rule standards, and audit trails of PHI access. The HHS Office for Civil Rights has clarified that AI vendors handling PHI are business associates subject to HIPAA.

SEC Regulations and Financial AI Financial advisory firms must consider SEC regulations when using AI. Regulation S-P requires safeguards for client information. The SEC has issued guidance on AI use in investment advice, emphasizing fiduciary duty and the need to ensure AI-generated recommendations are suitable and in client interests. AI tools that process client financial data must meet the same security standards as other technology.

State Privacy Laws State privacy laws — CCPA in California, comprehensive privacy laws in Virginia, Colorado, Connecticut, and others — impose obligations on AI systems that process personal data. These laws grant consumers rights to know what data is collected, request deletion, and opt out of certain processing. AI tools that process personal data must support these rights.

EU AI Act The EU AI Act, effective in stages from 2024 to 2026, introduces a risk-tiered framework for AI systems. Low-risk AI systems face minimal obligations. High-risk systems — including those used in healthcare, finance, and employment — face strict requirements including risk assessment, documentation, human oversight, and transparency. Organizations deploying AI in the EU market must understand which tier their systems fall into.

Emerging U.S. AI Legislation Several U.S. states have passed or proposed AI-specific legislation. Colorado AI Act requires risk assessments for high-risk AI systems. Illinois AI Video Interview Act regulates AI use in hiring. Other states are considering similar laws. Federal guidance, including the NIST AI Risk Management Framework and Executive Order 14110, provides direction even where binding regulations are not yet in place.

An AI compliance program translates regulatory obligations into operational practices. The program should include the following elements.

Compliance Inventory Start by mapping AI tools to applicable regulations. For each tool in the AI inventory, identify which regulations apply based on the data processed, the use case, and the jurisdiction. This mapping ensures that compliance efforts are targeted and proportionate.

Risk Assessment AI compliance risk assessment evaluates the likelihood and impact of regulatory violations. Tools that process PHI without a BAA represent high compliance risk. Tools that process personal data without supporting consumer rights represent moderate risk. Risk assessment helps prioritize compliance efforts.

Vendor Compliance Due Diligence Vendor due diligence is critical because most compliance obligations flow through to vendors. Verify that AI vendors have appropriate certifications (SOC 2, HITRUST for healthcare), will sign BAAs, and have documented data handling practices. Review vendor incident history and breach notification procedures.

Policy and Procedure Development Develop AI-specific policies that address regulatory requirements. Policies should cover data handling, approved use cases, prohibited uses, approval workflows, training requirements, and incident reporting. Procedures should define how compliance is verified and documented.

Training and Awareness Train employees on compliance obligations related to AI. Training should be practical and role-specific — different roles need different knowledge. Clinical staff need to understand PHI safeguards; financial advisors need to understand fiduciary obligations; all staff need to know how to report compliance concerns.

Documentation and Audit Readiness Maintain documentation that demonstrates compliance: the AI inventory, risk assessments, vendor agreements, policies, training records, and incident logs. This documentation is what regulators and auditors will request. If it is not documented, it did not happen.

For healthcare organizations, HIPAA compliance is the most critical AI compliance obligation. When AI tools process PHI, the full scope of HIPAA Privacy and Security Rules applies.

Key HIPAA compliance requirements for AI include:

Business Associate Agreements Any AI vendor that creates, receives, maintains, or transmits PHI must sign a BAA. Without a BAA, the vendor cannot process PHI and the AI tool cannot be used with patient data. Verify BAA status before onboarding any AI tool that may touch PHI.

Security Rule Safeguards AI tools must implement safeguards equivalent to HIPAA Security Rule standards. This includes access controls, audit controls, integrity controls, and transmission security. Vendors should document how their AI platform meets these requirements.

Minimum Necessary Configure AI tools to access only the minimum necessary PHI for the intended purpose. Avoid broad data access when narrower access suffices. Data minimization is both a HIPAA principle and a practical risk reduction strategy.

Audit Controls Maintain audit logs of AI tool usage — who accessed the tool, what data was processed, and when. Audit logs support breach investigation and compliance reporting.

Breach Notification Ensure AI vendors have breach notification procedures that align with HIPAA requirements. The BAA should specify notification timelines (no later than 60 days from discovery) and content requirements.

De-identification Where possible, use de-identified data with AI tools. De-identified data is not subject to HIPAA, reducing compliance burden. However, ensure de-identification meets HIPAA Safe Harbor or Expert Determination standards.

The EU AI Act represents the most comprehensive AI-specific regulation globally. While it applies primarily to AI systems used in the EU, its impact extends to organizations worldwide that deploy AI in the European market.

The EU AI Act categorizes AI systems into risk tiers:

Unacceptable Risk AI systems that pose unacceptable risk — such as social scoring, manipulative AI, and certain biometric uses — are prohibited. Organizations must ensure their AI tools do not fall into this category.

High Risk High-risk AI systems — including those used in healthcare, employment, credit, and critical infrastructure — face strict obligations. These include risk assessment before deployment, data quality assurance, technical documentation, human oversight, transparency, and post-market monitoring. Organizations deploying high-risk AI must maintain conformity documentation.

Limited Risk Limited-risk AI systems, such as chatbots and AI-generated content, must provide transparency to users. Users must be informed when they are interacting with AI.

Minimal Risk Minimal-risk AI systems face no specific obligations under the AI Act. Most productivity AI tools fall into this category.

For organizations operating in the EU or serving EU customers, understanding which tier their AI tools fall into is essential. Compliance with the EU AI Act may require adjustments to AI deployment practices, documentation, and transparency measures.

Beyond the EU, other international AI regulations are emerging. Canada Artificial Intelligence and Data Act, UK AI regulatory framework, and various national approaches all impose obligations that multinational organizations must track.

U.S. state privacy laws increasingly apply to AI systems that process personal data. While these laws do not regulate AI specifically, their data protection requirements extend to AI tools.

CCPA and CPRA California Consumer Privacy Act and California Privacy Rights Act grant consumers rights over their personal data. AI tools that process California residents personal data must support consumer rights to know, delete, and opt out of data sale or sharing. AI tools that process personal data for training models may trigger additional obligations.

Comprehensive State Privacy Laws Virginia, Colorado, Connecticut, Utah, and other states have enacted comprehensive privacy laws with similar consumer rights. Organizations must track requirements in each state where they operate. While the core rights are similar, implementation details vary.

AI-Specific State Laws Several states have enacted AI-specific legislation. Colorado AI Act requires risk assessments for high-risk AI systems used in consequential decisions. Illinois regulates AI use in video interviews. Other states are considering similar laws. These AI-specific requirements add to the broader privacy law obligations.

Compliance Strategy For multistate organizations, a practical approach is to implement the most stringent applicable requirements across all operations. This simplifies compliance by maintaining a single standard rather than varying by jurisdiction. However, track specific requirements in each state to ensure full compliance.

AI compliance is only as strong as the documentation that supports it. Regulators and auditors do not just want to know that you comply — they want evidence. Audit readiness means maintaining documentation that demonstrates compliance.

Essential compliance documentation includes: - AI inventory with data classification and regulatory mapping - Risk assessments for each high-impact AI tool - Vendor agreements including BAAs and data processing agreements - AI acceptable use policy and related procedures - Training records showing who was trained and when - Incident logs documenting any AI-related events and responses - Vendor due diligence records including security certifications - Audit logs of AI tool usage - Review records showing periodic compliance assessments

Documentation should be organized, accessible, and current. Assign responsibility for maintaining compliance documentation and establish a review cadence. Outdated documentation is almost as problematic as no documentation — it suggests that compliance is not actively managed.

When regulators or auditors request information, the ability to quickly produce organized documentation demonstrates that compliance is taken seriously. Conversely, an inability to produce documentation suggests that compliance is informal and unreliable — even if the organization is actually compliant in practice.