AI Compliance for Cybersecurity
Cybersecurity is addressed by 50 regulatory updates across 7 jurisdictions and 10 frameworks. This page tracks how regulators worldwide are approaching cybersecurity in the context of artificial intelligence.
Framework Requirements for Cybersecurity
Regulations Covering Cybersecurity
US Federal(14)
HIPAA Enforcement Data Dashboard and Complaint Outcomes
HHS publishes enforcement data showing how OCR closes cases, including technical assistance, corrective action, and other resolution categories, and notes that most investigations can take multiple years.
HIPAA Regulatory Initiatives on Reproductive Health and Security Rule
HHS says remaining Notice of Privacy Practices modifications from the reproductive health privacy rule remain in effect and must be complied with by February 16, 2026, while the agency also has a proposed Security Rule overhaul pending.
HHS points HIPAA-covered entities and business associates to periodic risk analysis guidance
HHS says OCR issues periodic guidance on the HIPAA Security Rule and that risk analysis is the first step in identifying and implementing safeguards for e-PHI.
HHS guidance on HIPAA, the FTC Act, and the Health Breach Notification Rule
HHS explains that companies collecting consumer health information may need to comply with HIPAA, the FTC Act, and the FTC’s Health Breach Notification Rule, and it summarizes the privacy, security, and breach-notification obligations that can apply.
HIPAA Security Rule risk analysis guidance
HHS OCR guidance explains that HIPAA risk analysis is the foundational, ongoing step for identifying and documenting risks to e-PHI and selecting appropriate safeguards.
European Union(13)
CNIL recommendations on AI system development under the GDPR
CNIL published recommendations explaining how the GDPR applies to the development of AI systems that process personal data, including purpose definition, lawful basis, data minimization, transparency, security, rights handling, and DPIA expectations.
ESAs publish Annual Work Programme for 2027
The European Supervisory Authorities published their 2027 work programme, which keeps digital operational resilience and DORA oversight of critical ICT third-party service providers as key priorities for the EU financial sector.
AP guidance on generative AI and the GDPR
The Dutch DPA published initial guidance on the lawful development and deployment of generative AI models under the GDPR for organisations that develop or deploy such models.
ESAs warn on external dependencies, cyber threats and private credit risks
The ESAs identify external dependencies, cyber threats linked to capable AI models, and private credit as key vulnerabilities for the EU financial system and call for stronger preparedness and monitoring.
AI Act consultations and implementation guidance for GPAI, sandboxes, and transparency
The Commission has opened or advanced multiple AI Act implementation workstreams for GPAI, high-risk classification, transparency, and regulatory sandboxes, meaning providers and deployers must now align their implementation plans to the emerging guidance rather than wait for finalised national practice.
International(11)
ISO/IEC 27090 explained guide on AI security threats
ISO's guide explains that ISO/IEC 27090 provides security guidance for AI systems, focusing on AI-specific threats, detection, and mitigation across the AI life cycle.
AICPA SOC 2 resources reaffirm current Trust Services Criteria for AI-enabled services
AICPA’s SOC resources confirm the current Trust Services Criteria baseline and do not create AI-specific rules, but they reinforce that AI-enabled services must still satisfy existing security, privacy, and processing integrity controls in audits.
NIST AI RMF revision and critical-infrastructure profile development
NIST says the AI RMF is being revised and that a new trustworthy-use profile for critical infrastructure is under development, while the baseline AI RMF 1.0 remains voluntary and headed for review no later than 2028.
ISO/IEC 42006:2025 defines requirements for AI management system certification bodies
ISO/IEC 42006:2025 supplements the requirements for bodies auditing and certifying AI management systems against ISO/IEC 42001; the ISO catalog records its publication in July 2025.
ISO AI management-system and adjacent AI standards pipeline expands
ISO’s AI standards pages and draft items show an active pipeline around AI management systems, audit/certification, societal concerns, and privacy protection, so organizations pursuing ISO-based assurance should update their standards watchlist now.
Australia(8)
eSafety legal notices to AI companion providers on child safety and harmful content
eSafety issued legal notices to four AI companion providers requiring them to explain how they are protecting Australian children from sexually explicit content, suicide and self-harm risks, and child sexual exploitation and abuse material.
Basic Online Safety Expectations and reporting guidance
The Basic Online Safety Expectations outline the Australian Government’s expectations that certain online service providers take reasonable steps to keep Australians safe, and eSafety can require reporting on how they are meeting them.
Register of Online Safety Codes and Standards
eSafety maintains a public register of Online Safety Codes and Standards, including unlawful material and age-restricted material codes, related standards, notices, and directions to comply.
eSafety findings on AI companion apps following October 2025 transparency notices
eSafety published findings from transparency notices issued to four AI companion service providers, identifying serious gaps in child safety, age assurance, trust and safety staffing, and model testing during the 1 July 2025 to 30 September 2025 reporting period.
Basic Online Safety Expectations
eSafety’s Basic Online Safety Expectations state that online service providers should take reasonable steps to keep Australians safe, including by making services safer, more transparent, and responsive to complaints and reporting obligations.
Switzerland(2)
FINMA supervisory expectations for AI use in supervised institutions
FINMA says it has set out its supervisory expectations for the use of AI in supervised institutions, focusing on risks that arise when AI is used in business processes.
FINMA sets governance and risk-management expectations for AI use in Swiss financial institutions
FINMA’s 2024 guidance states that Swiss financial institutions using AI must identify, limit, control, and monitor AI-related risks within their existing supervisory framework, so firms should immediately test whether their governance and model-risk controls are adequate.
Singapore(1)
Weekly digest
Leave your email to get each issue in your inbox. Free, no account required.
We use your email only for the digest. Privacy policy