AI Compliance for Data Governance
Data Governance is addressed by 50 regulatory updates across 9 jurisdictions and 7 frameworks. This page tracks how regulators worldwide are approaching data governance in the context of artificial intelligence.
Framework Requirements for Data Governance
Regulations Covering Data Governance
US Federal(19)
No SEC regulatory update in supplied sources
The supplied materials do not contain an SEC rule, order, or guidance update, so no SEC regulation can be distilled from the record.
HIPAA Enforcement Data Dashboard and Complaint Outcomes
HHS publishes enforcement data showing how OCR closes cases, including technical assistance, corrective action, and other resolution categories, and notes that most investigations can take multiple years.
HIPAA Regulatory Initiatives on Reproductive Health and Security Rule
HHS says remaining Notice of Privacy Practices modifications from the reproductive health privacy rule remain in effect and must be complied with by February 16, 2026, while the agency also has a proposed Security Rule overhaul pending.
HHS points HIPAA-covered entities and business associates to periodic risk analysis guidance
HHS says OCR issues periodic guidance on the HIPAA Security Rule and that risk analysis is the first step in identifying and implementing safeguards for e-PHI.
HHS covered-entity and business-associate scope guidance
HHS explains that the HIPAA Rules apply to covered entities and business associates, and that covered entities must use written business associate arrangements when delegating functions to business associates.
Singapore(7)
Guidance by Topic
The PDPC guidance-by-topic page is a directory that groups Singapore privacy resources by topic and resource type.
PDPC practical guidance on Ant International proof-of-concept and privacy-preserving AI
The PDPC published practical guidance titled Applicability of Data Protection Provisions in relation to Ant International’s Proof of Concept to Enhance Customer Engagement with Privacy Preserving AI.
PDPC consultation on advisory guidelines for personal data in AI recommendation and decision systems
The PDPC published a public consultation on proposed advisory guidelines for the use of personal data in AI recommendation and decision systems.
Proposed Guide to Synthetic Data Generation now available
The PDPC announced that the proposed guide to synthetic data generation is now available.
Singapore’s Approach to AI Governance
The PDPC published Singapore’s Approach to AI Governance as a guidance resource on AI governance.
Canada(5)
OPC guidance on AI and your business
The OPC says organizations using or developing generative AI should label AI-generated content or decisions, establish legal authority, be transparent, explain tools, limit data sharing, and embed privacy by design.
Office of the Privacy Commissioner of Canada AI and privacy resources
The OPC’s AI and privacy hub points to guidance, principles, news and collaboration on responsible, trustworthy and privacy-protective AI in Canada.
Your privacy and AI chatbots
The OPC advises users of AI chatbots to limit personal information shared because chatbot platforms may collect, store, reuse, or disclose what users enter.
Principles for responsible, trustworthy and privacy-protective generative AI technologies
The OPC issued privacy principles for generative AI that set out how organizations developing, providing, or using such systems should handle personal information, transparency, accountability, access, accuracy, and safeguards.
Canadian Guardrails for Generative AI code of practice
Canada’s voluntary generative AI code of practice proposes guardrails for safety, fairness, transparency, human oversight, robustness and accountability before binding AIDA rules take effect.
European Union(5)
CNIL recommendations on AI system development under the GDPR
CNIL published recommendations explaining how the GDPR applies to the development of AI systems that process personal data, including purpose definition, lawful basis, data minimization, transparency, security, rights handling, and DPIA expectations.
AEPD innovation and technology resources page updated with AI/privacy materials
The AEPD’s innovation-and-technology portal lists updated resources on AI, risk management, privacy by design, and age assurance, signaling where the agency is directing compliance attention.
CNIL AI and GDPR guidance on transparency for training data
The CNIL states that organisations building or reusing AI training datasets with personal data must inform data subjects, with detailed requirements depending on whether data was collected directly, indirectly, or reused.
AEPD explains the right not to be subject to solely automated decisions
The AEPD states that individuals have a right not to be subject to decisions based solely on automated processing, subject to limited exceptions and safeguards including human intervention and contestability.
CNIL topic page on artificial intelligence
The CNIL’s AI topic page points readers to its AI compliance materials and states that it has an action plan for deploying privacy-respecting AI systems.
Switzerland(4)
FDPIC Data Protection Impact Assessment Guidance
The FDPIC explains that private- and public-sector controllers must carry out a DPIA when processing is likely to create a high risk to personality or fundamental rights, and must seek an opinion if residual risk remains high.
Swiss data protection impact assessment guidance
The FDPIC explains when a DPIA is required for Swiss processing likely to create a high risk and when a consultation with the FDPIC is needed.
FINMA supervisory expectations for AI use in supervised institutions
FINMA says it has set out its supervisory expectations for the use of AI in supervised institutions, focusing on risks that arise when AI is used in business processes.
Swiss FDPIC guidance on AI and data protection, plus legislative roadmap
The FDPIC has made clear that Switzerland’s data protection law already applies to AI-supported processing and that the federal government is targeting an AI bill by the end of 2026, so organizations should harden transparency and automated-decision controls now.
United Kingdom(4)
ICO opens formal investigation into Grok
The ICO has opened formal investigations into XIUC and X.AI over Grok’s processing of personal data and potential generation of harmful sexualised image and video content.
ICO AI and data protection risk toolkit
The ICO says its AI toolkit is designed to help organisations reduce risks to individuals’ rights and freedoms caused by their own AI systems.
ICO data protection fining guidance
The ICO’s fining guidance explains when the Commissioner may issue a penalty notice and how the amount of any fine is determined under UK data protection law.
ICO AI and data protection guidance remains active but under review
The ICO says its AI guidance supports audit and enforcement activity and is under review following the Data (Use and Access) Act 2025, so UK organizations should keep using it as the current baseline while planning for revisions.
International(4)
AEPD blog on how algorithms influence automated systems using AI
The AEPD explains that meaningful transparency under the GDPR requires understanding how algorithms influence automated decisions, not just receiving generic statements that AI was used.
AICPA SOC 2 resources reaffirm current Trust Services Criteria for AI-enabled services
AICPA’s SOC resources confirm the current Trust Services Criteria baseline and do not create AI-specific rules, but they reinforce that AI-enabled services must still satisfy existing security, privacy, and processing integrity controls in audits.
NIST AI RMF revision and critical-infrastructure profile development
NIST says the AI RMF is being revised and that a new trustworthy-use profile for critical infrastructure is under development, while the baseline AI RMF 1.0 remains voluntary and headed for review no later than 2028.
ISO/IEC 42006:2025 defines requirements for AI management system certification bodies
ISO/IEC 42006:2025 supplements the requirements for bodies auditing and certifying AI management systems against ISO/IEC 42001; the ISO catalog records its publication in July 2025.
Ireland(1)
Weekly digest
Leave your email to get each issue in your inbox. Free, no account required.
We use your email only for the digest. Privacy policy