AI Compliance for Risk Management
Risk Management is addressed by 50 regulatory updates across 9 jurisdictions and 8 frameworks. This page tracks how regulators worldwide are approaching risk management in the context of artificial intelligence.
Framework Requirements for Risk Management
Regulations Covering Risk Management
US Federal(12)
No SEC regulatory update in supplied sources
The supplied materials do not contain an SEC rule, order, or guidance update, so no SEC regulation can be distilled from the record.
FDA AI-enabled medical device public list and transparency resource
The FDA’s AI-enabled medical device list is a periodically updated transparency resource that identifies authorized devices and encourages sponsors to include enough information in public summaries to support future tagging of foundation-model-based functionality.
FDA AI-enabled medical devices overview and resource list
The FDA describes its risk-based oversight of AI-enabled medical devices and provides a periodically updated public list for transparency and regulatory expectations.
HTI-5 proposed rule advances AI-enabled interoperability and deregulatory health IT changes
HHS says the HTI-5 proposed rule would streamline the ONC certification program, update information blocking regulations, and promote FHIR-based AI-enabled interoperability, with public comment open for 60 days after publication.
HHS points HIPAA-covered entities and business associates to periodic risk analysis guidance
HHS says OCR issues periodic guidance on the HIPAA Security Rule and that risk analysis is the first step in identifying and implementing safeguards for e-PHI.
Australia(11)
Basic Online Safety Expectations and transparency reporting guidance
eSafety says that social media, messaging and gaming service providers and other apps and websites will take reasonable steps to keep Australians safe, and that it can require providers to report on how they are meeting the Expectations.
eSafety legal notices to AI companion providers on child safety and harmful content
eSafety issued legal notices to four AI companion providers requiring them to explain how they are protecting Australian children from sexually explicit content, suicide and self-harm risks, and child sexual exploitation and abuse material.
Basic Online Safety Expectations and reporting guidance
The Basic Online Safety Expectations outline the Australian Government’s expectations that certain online service providers take reasonable steps to keep Australians safe, and eSafety can require reporting on how they are meeting them.
eSafety publishes transparency notice responses for AI services
eSafety publishes a transparency-notice report on AI services and explains how it uses enforceable notices to assess compliance with the Basic Online Safety Expectations.
Australia Age-Restricted Material Codes fully commence
Australia's Age-Restricted Material Codes have fully commenced, requiring online services across the ecosystem to put in place age-appropriate protections for children and age assurance for access to certain adult material.
European Union(9)
AI Act Fact Page
The fact page presents the AI Act’s risk-based structure, GPAI transparency and systemic-risk obligations, and the AI governance architecture.
EU AI Act: draft implementing act for AI regulatory sandboxes
The Commission opened feedback on a draft implementing act that would set common rules for establishing and operating AI regulatory sandboxes under the AI Act.
EU AI Act: draft guidelines on classification of high-risk AI systems
The Commission opened a consultation on draft guidelines to help providers, deployers, and market surveillance authorities assess whether an AI system is high-risk.
CNIL recommendations on AI system development under the GDPR
CNIL published recommendations explaining how the GDPR applies to the development of AI systems that process personal data, including purpose definition, lawful basis, data minimization, transparency, security, rights handling, and DPIA expectations.
ESAs publish Annual Work Programme for 2027
The European Supervisory Authorities published their 2027 work programme, which keeps digital operational resilience and DORA oversight of critical ICT third-party service providers as key priorities for the EU financial sector.
Canada(5)
OPC guidance on AI and your business
The OPC says organizations using or developing generative AI should label AI-generated content or decisions, establish legal authority, be transparent, explain tools, limit data sharing, and embed privacy by design.
OPC leadership on AI and privacy
The OPC says it collaborates with domestic and international partners on statements, resolutions and toolkits to promote responsible, trustworthy and privacy-protective AI.
Office of the Privacy Commissioner of Canada AI and privacy resources
The OPC’s AI and privacy hub points to guidance, principles, news and collaboration on responsible, trustworthy and privacy-protective AI in Canada.
Principles for responsible, trustworthy and privacy-protective generative AI technologies
The OPC issued privacy principles for generative AI that set out how organizations developing, providing, or using such systems should handle personal information, transparency, accountability, access, accuracy, and safeguards.
Canadian Guardrails for Generative AI code of practice
Canada’s voluntary generative AI code of practice proposes guardrails for safety, fairness, transparency, human oversight, robustness and accountability before binding AIDA rules take effect.
International(4)
Clear 2022 comprehensive governance of algorithms special action
The Cyberspace Administration of China launched a special action in April 2022 to push implementation of the algorithm recommendation provisions through self-inspection, inspections, filing, and rectification.
AI Guidelines for Business Ver. 1.0
METI and MIC compiled AI Guidelines for Business Ver. 1.0 by integrating and updating prior AI guidelines for a broad range of AI business operators.
OECD AI Law Radar tool
The OECDs AI Law Radar is a daily refreshed tracker of AI laws, regulations, and obligations across jurisdictions for compliance and governance teams.
ISO/IEC 27090 explained guide on AI security threats
ISO's guide explains that ISO/IEC 27090 provides security guidance for AI systems, focusing on AI-specific threats, detection, and mitigation across the AI life cycle.
United Kingdom(4)
FCA review of the long-term impact of AI on retail financial services
The FCA is reviewing how AI may reshape retail financial services by 2030 and beyond and is seeking views on future technology, market, consumer, and regulatory implications rather than proposing new rules now.
ICO guidance on when penalty notices may be issued
The ICO explains that penalty notices are assessed case by case and will be considered with reference to seriousness, mitigating or aggravating factors, and whether a fine would be effective, proportionate and dissuasive.
ICO opens formal investigation into Grok
The ICO has opened formal investigations into XIUC and X.AI over Grok’s processing of personal data and potential generation of harmful sexualised image and video content.
ICO and Turing guidance on explaining decisions made with AI
The ICO and Alan Turing Institute say organisations should provide practical explanations of AI-assisted decisions to affected individuals and to internal decision-makers.
Singapore(3)
Guidance by Topic
The PDPC guidance-by-topic page is a directory that groups Singapore privacy resources by topic and resource type.
PDPC practical guidance on Ant International proof-of-concept and privacy-preserving AI
The PDPC published practical guidance titled Applicability of Data Protection Provisions in relation to Ant International’s Proof of Concept to Enhance Customer Engagement with Privacy Preserving AI.
PDPC consultation on advisory guidelines for personal data in AI recommendation and decision systems
The PDPC published a public consultation on proposed advisory guidelines for the use of personal data in AI recommendation and decision systems.
Switzerland(1)
Weekly digest
Leave your email to get each issue in your inbox. Free, no account required.
We use your email only for the digest. Privacy policy