CoreQ Academy4.3 Summarize the impact of compliance on business use and development of AI.
AI regulation and standards are maturing quickly. Know the main frameworks, what they expect, and how corporate policy turns them into daily rules.
Regulations and standards
- European Union (EU) AI Act
- EU law that classifies AI by risk: prohibited practices (such as social scoring), high-risk systems with strict requirements (risk management, data quality, documentation, human oversight, conformity assessment), transparency duties for systems like chatbots and deepfakes, and obligations for general-purpose AI models. Applies to providers and deployers serving the EU market.
- Organisation for Economic Co-operation and Development (OECD) standards
- The OECD AI Principles: inclusive growth and well-being, human rights and fairness, transparency and explainability, robustness and safety, and accountability. Adopted by many governments as a baseline.
- ISO AI standards
- International standards such as ISO/IEC 42001 (AI management system, certifiable), ISO/IEC 23894 (AI risk management) and ISO/IEC 22989 (AI concepts and terminology).
- National Institute of Standards and Technology (NIST) AI Risk Management Framework (AI RMF)
- Voluntary US framework organised into four functions: Govern, Map, Measure and Manage, with a generative AI profile. Widely used to structure AI risk programmes.
Corporate policies
- Sanctioned vs. unsanctioned
- Approved AI tools that meet security and contract requirements versus tools staff use without approval (shadow AI). Policy should offer good sanctioned options so people do not need unsanctioned ones.
- Private vs. public models
- Private (self-hosted or enterprise-contracted) models keep data under your control and terms; public consumer models may retain or train on inputs.
- Sensitive data governance
- Rules on which data classifications may be used with which models, plus redaction, logging and retention requirements.
Third-party compliance evaluations
- Third-party compliance evaluations
- Assessing AI vendors: security reports (SOC 2, ISO 27001/42001), data use and retention terms, model training on your data, sub-processors, and contractual rights to audit.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 4.3 of the publicly available CompTIA SecAI+ CY0-001 exam objectives (Exam objectives V1, document version 1.1). Not affiliated with or endorsed by CompTIA. Contains no exam questions.