Laws & Frameworks: A Working Map

AI laws and standards are arriving in many regions, and they change often. A governance lead does not need to be a lawyer. You do need to know the main names and ideas, so you can ask good questions and plan controls. This lesson gives a map of the main frameworks and shows how to turn them into practice.

Use this lesson as a map

The summaries below are simplified. Details, dates and scope change. Always check the current text, and ask your legal team how a rule applies to you.

The EU AI Act

The EU AI Act is a European law that takes a risk-based approach. It sorts AI uses into levels.

• Unacceptable risk: certain uses are banned.
• High risk: uses in sensitive areas, such as hiring, education, essential services and some safety products, face strict duties like risk management, data quality, documentation, human oversight and testing.
• Limited risk: some uses need transparency, such as telling people they are talking to an AI.
• Minimal risk: most uses face few specific duties.
• General-purpose AI models have their own duties for the providers of those models.

Duties phase in over several years, and they apply to providers and to those who use AI in the EU market. Check the current timetable.

Privacy law

Privacy laws such as the GDPR apply to AI as they do to any use of personal data. Common ideas include a lawful reason for processing, using only the data you need, telling people how you use it, honoring their rights, and impact assessments for risky processing. Some rules limit decisions made only by automated means that significantly affect people.

NIST AI Risk Management Framework

The NIST AI RMF is a voluntary guide from the United States. It groups risk work into four functions. Govern: set up culture, roles and policy. Map: understand the context and the risks. Measure: test and track them. Manage: act on what you find. It is widely used as a shared language, even outside the United States.

ISO/IEC standards

ISO/IEC 42001 describes an AI management system, which is a set of policies, processes and roles an organization can be audited against. Other ISO standards give guidance on AI risk and related topics. Certification can help with customers who ask for proof.

Sector and local rules

• Financial services, healthcare, employment and insurance often have extra rules on decisions about people.
• Some regions or cities have rules on automated hiring tools.
• Copyright and intellectual property rules affect training data and generated content.
• Consumer protection law applies to claims about what your AI can do.

From law to controls

REQUIREMENT (example)            WHAT IT MEANS IN PRACTICE               CONTROL
Tell people they talk to an AI   A clear notice in the chat window         Template + design check
Human oversight of high-risk use A trained person can understand, override   Role description, training,
                                 and stop the system                      override test
Keep records                     Logs, versions, test results, decisions   Retention standard, evidence folder
Data quality                     Data fits the purpose and is checked      Data review step in the gate
Risk management                  Risks found, rated, treated, reviewed     Risk register, review cadence

Keeping up

• Follow official sources and a trusted legal update, not social media summaries.
• Set a review date to check changes every quarter.
• Keep a simple table of laws that may apply, owner, status and next step.
• Join industry groups to share practice.