AI laws, AI management-system standards and AI risk frameworks: the EU AI Act, ISO/IEC 42001, NIST AI RMF, ISO/IEC 23894, US state and city rules and India's guidelines.
AI compliance is the newest category in this directory and the one changing fastest. The EU AI Act is the first broad AI law, with obligations applying in stages and some dates being revised while this hub is maintained. Elsewhere, governments have so far used targeted laws (on hiring tools or algorithmic discrimination), sector rules and voluntary guidance.
Laws
The EU AI Act classifies AI systems by risk. Some practices are prohibited, high-risk systems carry detailed obligations for providers and deployers, certain systems carry transparency duties, and general-purpose AI models have their own rules. In the United States, laws so far are state and local: Colorado's automated decision law, which replaced its 2024 AI Act and takes effect in 2027, and New York City's Local Law 144 on automated employment decision tools. Existing privacy, consumer protection and anti-discrimination laws also apply to AI.
Standards and frameworks
ISO/IEC 42001 is a certifiable AI management system standard, built like ISO/IEC 27001. ISO/IEC 23894 gives guidance on AI risk management. The NIST AI Risk Management Framework is voluntary US guidance organised around four functions: govern, map, measure and manage. India's AI Governance Guidelines from MeitY set out principles and recommendations rather than binding rules.
What to do first
Make an inventory of where you build or use AI, classify each use by its risk, and keep records of data, testing and human oversight. That inventory is the starting point for every framework here, and the guides show how to take it further.
Because these rules are moving, every AI guide is reviewed every three months and shows its review date at the top.
At a glance
Mandatory or voluntary: ai governance & compliance
Colorado, United States. Applies to developers and deployers of AI or automated decision-making technology used in consequential decisions about Colorado consumers.
Colorado General Assembly; enforced by the Colorado Attorney General
European Union. Also applies to providers and deployers outside the EU when they place AI systems on the EU market or the output of their AI is used in the EU (Article 2).
European Parliament and Council of the EU; the European AI Office (European Commission) and national market surveillance authorities
New York City, United States. Applies to employers and employment agencies using automated employment decision tools for candidates and employees in the city.
New York City Council; enforced by the NYC Department of Consumer and Worker Protection (DCWP)
India. Applies to intermediaries offering services to users in India, including foreign platforms, and to digital news publishers and online curated content providers.
Ministry of Electronics and Information Technology (MeitY), with Part III administered by the Ministry of Information and Broadcasting
Colorado Senate Bill 24-205 (Consumer Protections for Artificial Intelligence), repealed and reenacted by Senate Bill 26-189 as an automated decision-making technology law
Colorado passed the first broad US state law on high-risk AI in 2024. SB 24-205 required developers and deployers of AI used in consequential decisions, such as hiring, lending, housing and healthcare, to prevent algorithmic discrimination and complete impact assessments. After delays and a federal court stay, Colorado repealed and reenacted it in May 2026 as SB 26-189, a narrower notice-based law on automated decision-making technology that takes effect on 1 January 2027.
Artificial Intelligence Act, Regulation (EU) 2024/1689, as amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744
The EU AI Act is the European Union's law on artificial intelligence. It bans certain AI practices, sets strict requirements for high-risk AI systems used in areas such as employment, education, credit and critical infrastructure, imposes transparency duties on chatbots and AI-generated content, and regulates general-purpose AI models. It applies in stages: prohibitions since February 2025, general-purpose AI rules since August 2025, transparency from August 2026, and high-risk rules from December 2027 and August 2028 after the 2026 Digital Omnibus amendments.
India AI Governance Guidelines: Enabling Safe and Trusted AI Innovation (MeitY, IndiaAI Mission, November 2025)
India's AI Governance Guidelines, released by MeitY on 5 November 2025, set out how India intends to govern AI without a standalone AI law for now. They define seven guiding principles, or sutras, and recommendations across six pillars, from infrastructure to accountability. They propose graded liability, AI incident reporting, content authentication, regulatory sandboxes and new institutions, and rely on existing laws such as the IT Act, IT Rules and DPDP Act for enforcement.
ISO/IEC 23894: Information technology, Artificial intelligence, Guidance on risk management
ISO/IEC 23894 gives guidance on managing risks that arise when organisations develop, provide or use AI. It applies the ISO 31000 risk management principles, framework and process to AI, adds AI-specific objectives such as fairness, transparency, safety, security, privacy and accountability, lists common AI risk sources such as data quality, lack of transparency and level of automation, and maps risk management to each stage of the AI lifecycle. It complements ISO/IEC 42001 and the NIST AI RMF.
ISO/IEC 42001 Information technology: Artificial intelligence: Management system
ISO/IEC 42001 is the international standard for an AI management system (AIMS): a structured way for organisations that develop, provide or use AI to set AI policy, assess AI risks and impacts, control the AI life cycle and keep improving. It follows the same clause structure as ISO/IEC 27001, adds AI-specific requirements such as an AI system impact assessment, and lists 38 reference controls in Annex A. It is voluntary and certifiable.
The NIST AI Risk Management Framework is voluntary US guidance for managing the risks of AI systems throughout their life cycle. It describes the characteristics of trustworthy AI and organises risk management into four functions: Govern, Map, Measure and Manage. A companion Playbook suggests actions, and a Generative AI Profile addresses risks specific to generative models. It is not certifiable, but it is widely used to structure AI governance and is named as a recognised framework in some US laws.
New York City Local Law 144 of 2021 on Automated Employment Decision Tools, with DCWP rules (6 RCNY 5-300 and following)
New York City's Local Law 144 regulates automated employment decision tools: software that uses machine learning, statistics, data analytics or AI to produce scores, classifications or recommendations that substantially assist or replace hiring and promotion decisions. Employers and employment agencies may use such a tool only if it had an independent bias audit within the past year, a summary of results is public, and candidates receive notice. Enforcement began on 5 July 2023, and a December 2025 state audit called for stronger enforcement.
Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended up to 2026
India's IT Rules 2021 set the due diligence that intermediaries such as social media platforms, marketplaces, hosting providers, app stores and messaging services must follow to keep legal immunity for user content. They require published rules for users, grievance officers, fast removal of unlawful content on orders, data retention and cooperation with authorities. Significant social media intermediaries have extra duties, and 2026 amendments added labelling of AI-generated synthetic content and much shorter takedown deadlines.
Does the EU AI Act apply to companies outside the EU?
It can. It applies to providers placing AI systems on the EU market and to providers and deployers outside the EU where the output of the system is used in the EU. The guide explains the roles and the dates.
Is ISO/IEC 42001 certification required by the EU AI Act?
No. The Act does not require ISO/IEC 42001 certification. An AI management system can help you organise the risk management, documentation and oversight the Act asks for.
Is the NIST AI RMF mandatory?
No. It is voluntary guidance from NIST. Some organisations and contracts adopt it as their AI risk method.
We build the parts auditors and privacy laws look for: role-based access, audit logs, encryption, consent records, data export and erasure, and secure development practices. Tell us about your product and get a free quote within one business day.
