AI Compliance Checklist 2026: EU AI Act, GDPR, HIPAA, SOC 2, and ISO 42001

By Fadi Updated May 8, 2026 14 min read Strategy

TL;DR — AI compliance in 2026 is a multi-framework matrix, not a single checklist. Knowlee: "Organizations must satisfy obligations across EU AI Act, GDPR, ISO 42001, NIST AI RMF, and sector-specific regulations simultaneously." Neomanex: "EU AI Act high-risk deadline August 2026 — penalties up to 35M or 7% global revenue. HIPAA 2026: encryption and MFA mandatory. SOC 2: AI-specific governance required." Polygraf: "Compliance is not a checkbox, it is a matrix — each regulation has its own trigger, deadline, and penalty schedule." Trustible: "Run one compliance program mapped across all three frameworks — EU AI Act, NIST AI RMF, ISO 42001 — without duplicating work." BrianOnAI: "200+ controls, 90-day roadmap, requirement-by-requirement verification across every major jurisdiction." Five compliance layers: inventory (AI system registry), classification (risk tiering), controls (technical safeguards), documentation (evidence and audit trails), monitoring (continuous compliance). Integrate with governance ownership, readiness checklist, audit logging, and incident response.

Polygraf frames the challenge: "The question 'are we compliant with our AI deployment?' has no single answer in 2026 because there is no single regulator. An enterprise that deploys one customer-facing AI feature can be subject to the EU AI Act, the Colorado automated-decision law, California's transparency laws, sector rules such as HIPAA or GLBA, and NYC's bias-audit law — each with its own trigger, its own deadline and its own penalty schedule. Compliance is not a checkbox, it is a matrix."

BrianOnAI quantifies the stakes: "The AI regulatory landscape has fundamentally shifted from voluntary guidelines to enforceable law. The EU AI Act is now active with penalties reaching 35 million or 7% of global revenue. US states are following with Colorado's comprehensive AI Act (February 2026) and NYC's hiring algorithm law already in force."

AI Compliance Framework Architecture

flowchart TD subgraph Regs["Regulatory Frameworks"] EUAI["EU AI Act
Penalties: 35M or 7% revenue
Deadline: Aug 2026"] GDPR["GDPR
Penalties: 20M or 4% revenue
72-hour breach reporting"] HIPAA["HIPAA 2026
Encryption + MFA mandatory
BAA required for AI vendors"] SOC2["SOC 2 2026
AI governance required
Bias testing, data lineage"] ISO["ISO 42001
Certifiable AI management
system standard"] NIST["NIST AI RMF
Voluntary US framework
Govern outcomes"] end subgraph Layers["Five Compliance Layers"] L1["1. Inventory
AI system registry
(purpose, data, risk tier)"] L2["2. Classification
Risk tier assignment
(prohibited, high, limited, minimal)"] L3["3. Controls
Technical safeguards
(encryption, access, logging)"] L4["4. Documentation
Evidence and audit trails
(DPIAs, technical docs)"] L5["5. Monitoring
Continuous compliance
(audits, reviews, updates)"] end subgraph Map["Cross-Framework Mapping"] Inventory["AI Inventory
→ EU AI Act, ISO 42001, SOC 2"] Classify["Risk Classification
→ EU AI Act, NIST AI RMF"] Controls["Technical Controls
→ GDPR, HIPAA, SOC 2"] Docs["Documentation
→ EU AI Act, GDPR, ISO 42001"] Monitor["Monitoring
→ All frameworks"] end subgraph Sectors["Sector-Specific"] Finance["Finance: SR 11-7, ECOA, FCRA"] Healthcare["Healthcare: HIPAA, BAA"] Employment["Employment: EEOC, NYC AEDT"] Insurance["Insurance: NAIC"] end Regs --> Layers L1 --> L2 --> L3 --> L4 --> L5 Layers --> Map Map --> Sectors

Compliance Framework Comparison

Framework	Type	Penalty	Key Requirement	Deadline
EU AI Act	Binding regulation	35M or 7% revenue	Risk classification, technical docs, human oversight	Aug 2026 (high-risk)
GDPR	Binding regulation	20M or 4% revenue	Legal basis, DPIA, automated decision safeguards	Active
HIPAA 2026	Binding regulation	Per violation	BAA, AES-256, MFA, 72-hour recovery	Late 2026 (final rule)
SOC 2	Audit standard	Loss of certification	AI governance, bias testing, data lineage	Active (2026 update)
ISO 42001	Certifiable standard	No certification	AI management system, inventory, continual improvement	Active
NIST AI RMF	Voluntary framework	None	Govern, map, measure, manage AI risks	Active

EU AI Act Risk Tiers and Requirements

Risk Tier	Examples	Requirements	Penalty
Prohibited	Social scoring, manipulative AI	Banned entirely	35M or 7% revenue
High-risk	Hiring, credit, medical, education, critical infrastructure	Risk management, data governance, technical documentation, logging, human oversight, conformity assessment	35M or 7% revenue
Limited risk	Chatbots, AI-generated content	Article 50 transparency labels, disclosure of AI	15M or 3% revenue
Minimal risk	Spam filters, recommendation engines	No specific requirements	None

Implementation

from dataclasses import dataclass, field
from datetime import datetime, timezone
from typing import Optional
from enum import Enum

class RiskTier(Enum):
    PROHIBITED = "prohibited"
    HIGH_RISK = "high_risk"
    LIMITED = "limited"
    MINIMAL = "minimal"

class ComplianceFramework(Enum):
    EU_AI_ACT = "EU AI Act"
    GDPR = "GDPR"
    HIPAA = "HIPAA"
    SOC2 = "SOC 2"
    ISO_42001 = "ISO 42001"
    NIST_AI_RMF = "NIST AI RMF"

@dataclass
class AIComplianceChecklist:
    """Enterprise AI compliance across multiple frameworks."""

    eu_ai_act_penalties = "35M EUR or 7% global revenue"
    gdpr_penalties = "20M EUR or 4% global revenue"
    gdpr_breach_reporting_hours = 72
    eu_ai_act_incident_reporting_hours = 72
    hipaa_breach_reporting_days = 60

    def __init__(self, db, audit):
        self.db = db
        self.audit = audit

    async def classify_ai_system(self, tenant_id: str,
                                 system: dict) -> dict:
        """Classify AI system by EU AI Act risk tier."""
        use_case = system.get("use_case", "").lower()
        data_types = system.get("data_types", [])

        # Prohibited use cases
        prohibited = ["social scoring", "manipulative",
                      "real-time biometric surveillance"]
        if any(p in use_case for p in prohibited):
            tier = RiskTier.PROHIBITED
        # High-risk use cases (Annex III)
        elif any(k in use_case for k in [
            "hiring", "recruitment", "credit", "loan",
            "medical", "diagnosis", "education", "exam",
            "critical infrastructure", "law enforcement",
            "migration", "asylum", "border control"]):
            tier = RiskTier.HIGH_RISK
        # Limited risk (transparency required)
        elif any(k in use_case for k in [
            "chatbot", "ai-generated content", "deepfake",
            "emotion recognition"]):
            tier = RiskTier.LIMITED
        else:
            tier = RiskTier.MINIMAL

        classification = {
            "system_id": system["system_id"],
            "tenant_id": tenant_id,
            "name": system["name"],
            "use_case": system["use_case"],
            "risk_tier": tier.value,
            "data_types": data_types,
            "frameworks_applicable": self._get_applicable_frameworks(
                tier, data_types),
            "requirements": self._get_requirements(tier),
            "classified_at": datetime.now(timezone.utc),
        }

        await self.db.insert("ai_compliance_classifications",
                             classification)

        await self.audit.log(
            tenant_id=tenant_id,
            action="ai_system_classified",
            entity_type="compliance_classification",
            after=classification,
        )

        return classification

    def _get_applicable_frameworks(self, tier: RiskTier,
                                   data_types: list) -> list:
        """Determine which frameworks apply."""
        frameworks = [ComplianceFramework.EU_AI_ACT.value]

        if "personal_data" in data_types:
            frameworks.append(ComplianceFramework.GDPR.value)
        if "phi" in data_types or "health_data" in data_types:
            frameworks.append(ComplianceFramework.HIPAA.value)

        frameworks.extend([
            ComplianceFramework.SOC2.value,
            ComplianceFramework.ISO_42001.value,
            ComplianceFramework.NIST_AI_RMF.value,
        ])

        return frameworks

    def _get_requirements(self, tier: RiskTier) -> list:
        """Get compliance requirements for a risk tier."""
        if tier == RiskTier.PROHIBITED:
            return ["SYSTEM_MUST_BE_DISABLED",
                    "Remediation plan within 30 days"]

        if tier == RiskTier.HIGH_RISK:
            return [
                "Risk management system (Article 9)",
                "Data governance and quality (Article 10)",
                "Technical documentation (Article 11)",
                "Record-keeping / logging (Article 12)",
                "Transparency to deployers (Article 13)",
                "Human oversight (Article 14)",
                "Accuracy, robustness, cybersecurity (Article 15)",
                "Conformity assessment before deployment",
                "CE marking and EU declaration of conformity",
                "Post-market monitoring (Article 72)",
                "Serious incident reporting within 72 hours (Article 73)",
                "GDPR DPIA if processing personal data (Article 35)",
                "Bias testing and documentation",
                "Data lineage tracking",
            ]

        if tier == RiskTier.LIMITED:
            return [
                "Article 50 transparency: disclose AI to users",
                "Label AI-generated content",
                "Chatbot disclosure: inform users they are interacting with AI",
            ]

        return ["No specific requirements under EU AI Act"]

    async def check_gdpr_compliance(self, tenant_id: str,
                                    system_id: str) -> dict:
        """Check GDPR compliance for an AI system."""
        system = await self.db.fetch_one(
            "SELECT * FROM ai_compliance_classifications WHERE system_id = $1 AND tenant_id = $2",
            system_id, tenant_id,
        )

        checks = {
            "article_6_legal_basis": False,
            "article_9_special_category": False,
            "article_22_automated_decisions": False,
            "article_22_safeguards": False,
            "article_35_dpia_completed": False,
            "article_36_authority_consulted": False,
            "data_subject_rights_implemented": False,
            "breach_reporting_process": False,
            "72_hour_notification_capability": False,
        }

        # In production: check actual documentation and processes
        return {
            "system_id": system_id,
            "framework": "GDPR",
            "checks": checks,
            "compliant": all(checks.values()),
            "non_compliant_items": [
                k for k, v in checks.items() if not v
            ],
        }

    async def check_hipaa_compliance(self, tenant_id: str,
                                     system_id: str) -> dict:
        """Check HIPAA compliance for an AI system."""
        checks = {
            "baa_executed_with_vendor": False,
            "encryption_at_rest_aes256": False,
            "encryption_in_transit_tls13": False,
            "mfa_all_phi_access": False,
            "minimum_necessary_access": False,
            "vulnerability_scanning_6months": False,
            "system_recovery_72hour": False,
            "audit_logging_enabled": False,
            "breach_notification_60_days": False,
        }

        return {
            "system_id": system_id,
            "framework": "HIPAA",
            "checks": checks,
            "compliant": all(checks.values()),
            "non_compliant_items": [
                k for k, v in checks.items() if not v
            ],
        }

    async def generate_compliance_report(self, tenant_id: str) -> dict:
        """Generate comprehensive compliance report across all frameworks."""
        systems = await self.db.fetch_all(
            "SELECT * FROM ai_compliance_classifications WHERE tenant_id = $1",
            tenant_id,
        )

        report = {
            "tenant_id": tenant_id,
            "total_systems": len(systems),
            "generated_at": datetime.now(timezone.utc),
            "risk_distribution": {
                "prohibited": 0, "high_risk": 0,
                "limited": 0, "minimal": 0,
            },
            "frameworks": {},
            "non_compliant_systems": [],
        }

        for system in systems:
            tier = system["risk_tier"]
            report["risk_distribution"][tier] = (
                report["risk_distribution"].get(tier, 0) + 1)

            for fw in system["frameworks_applicable"]:
                if fw not in report["frameworks"]:
                    report["frameworks"][fw] = {
                        "total": 0, "compliant": 0, "non_compliant": 0
                    }
                report["frameworks"][fw]["total"] += 1

        return report

AI Compliance Checklist 2026

[ ] Inventory all AI systems: name, purpose, data, risk tier, owner
[ ] More than 50% of organizations lack an AI inventory — create one
[ ] Classify each AI system by EU AI Act risk tier (prohibited, high, limited, minimal)
[ ] Identify prohibited use cases and disable them immediately
[ ] Identify high-risk use cases: hiring, credit, medical, education, critical infrastructure
[ ] Identify limited-risk use cases: chatbots, AI-generated content, deepfakes
[ ] Map applicable frameworks per system: EU AI Act, GDPR, HIPAA, SOC 2, ISO 42001, NIST AI RMF
[ ] Run one compliance program mapped across all frameworks (not separate programs)
[ ] EU AI Act: implement risk management system (Article 9)
[ ] EU AI Act: implement data governance and quality (Article 10)
[ ] EU AI Act: maintain technical documentation (Article 11)
[ ] EU AI Act: implement record-keeping and logging (Article 12)
[ ] EU AI Act: ensure transparency to deployers (Article 13)
[ ] EU AI Act: implement human oversight (Article 14)
[ ] EU AI Act: ensure accuracy, robustness, cybersecurity (Article 15)
[ ] EU AI Act: complete conformity assessment before deployment
[ ] EU AI Act: obtain CE marking and EU declaration of conformity
[ ] EU AI Act: implement post-market monitoring (Article 72)
[ ] EU AI Act: establish serious incident reporting within 72 hours (Article 73)
[ ] GDPR: document Article 6 legal basis for all personal data processing
[ ] GDPR: document Article 9 legal basis for special category data
[ ] GDPR: identify Article 22 automated decisions with legal/significant effects
[ ] GDPR: document Article 22(2) exceptions with legal rationale
[ ] GDPR: implement Article 22(3) safeguards (right to contest, express view)
[ ] GDPR: complete DPIA (Article 35) for high-risk AI processing
[ ] GDPR: review DPIAs when AI systems are significantly modified
[ ] GDPR: consult supervisory authority if DPIA indicates high residual risk (Article 36)
[ ] GDPR: implement data subject rights (access, rectification, erasure, portability)
[ ] GDPR: establish 72-hour breach reporting process
[ ] HIPAA: execute BAA with any AI vendor processing PHI
[ ] HIPAA: if AI provider will not sign BAA, do not process PHI with them
[ ] HIPAA: implement AES-256 encryption at rest (mandatory 2026)
[ ] HIPAA: implement TLS 1.3+ encryption in transit (mandatory 2026)
[ ] HIPAA: implement MFA for all PHI access (mandatory 2026)
[ ] HIPAA: implement minimum necessary access controls
[ ] HIPAA: conduct vulnerability scanning every 6 months
[ ] HIPAA: ensure 72-hour system recovery capability
[ ] HIPAA: enable audit logging for all PHI access
[ ] HIPAA: establish 60-day breach notification process
[ ] SOC 2: map AI governance controls to Trust Services Criteria
[ ] SOC 2: implement bias testing and documentation
[ ] SOC 2: implement data lineage tracking
[ ] SOC 2: implement explainability for AI decisions
[ ] SOC 2: maintain evidence of control operation
[ ] ISO 42001: establish AI management system
[ ] ISO 42001: maintain AI system inventory
[ ] ISO 42001: implement continual improvement process
[ ] ISO 42001: ensure audit-ready documentation
[ ] NIST AI RMF: implement Govern function (policies, roles, accountability)
[ ] NIST AI RMF: implement Map function (context, risk identification)
[ ] NIST AI RMF: implement Measure function (assessment, monitoring)
[ ] NIST AI RMF: implement Manage function (risk response, documentation)
[ ] Sector-specific: Finance — SR 11-7 model risk management, ECOA, FCRA
[ ] Sector-specific: Healthcare — HIPAA, BAA, PHI controls
[ ] Sector-specific: Employment — EEOC, NYC AEDT bias audit, Colorado AI Act
[ ] Sector-specific: Insurance — NAIC Model Bulletin
[ ] Implement inline detection and redaction of regulated data at AI interaction point
[ ] Maintain tamper-evident log of every AI interaction
[ ] Implement AI-generated content disclosure (Article 50)
[ ] Implement chatbot transparency (inform users of AI interaction)
[ ] Consider self-hosted AI to eliminate data sovereignty gaps
[ ] Self-hosted: full data control, complete audit trails, no third-party BAAs
[ ] Conduct quarterly compliance reviews
[ ] Track regulatory changes and update compliance program
[ ] Prepare audit evidence: documentation, logs, DPIAs, technical docs
[ ] Establish AI governance ownership for compliance
[ ] Conduct AI readiness assessment including compliance
[ ] Log all compliance events in audit logs
[ ] Establish AI incident response with regulatory notification
[ ] Apply RBAC to compliance data
[ ] Apply zero-trust to AI systems processing regulated data
[ ] Apply OWASP LLM Top 10 security controls
[ ] Set up platform monitoring for compliance
[ ] Test: compliance classification matches actual risk
[ ] Test: GDPR checks identify non-compliant items
[ ] Test: HIPAA checks identify missing BAAs
[ ] Document compliance framework mapping and evidence collection process

FAQ

What is the EU AI Act compliance deadline?

The EU AI Act high-risk AI systems deadline is August 2, 2026, with penalties up to 35 million EUR or 7% of global annual revenue. Neomanex: "High-risk AI systems (Annex III) compliance deadline. Finland became the first EU member state with full enforcement powers on January 1, 2026. Penalties up to 35M or 7% global revenue." Polygraf: "Risk management, technical documentation, conformity assessment and human oversight of high-risk systems. Provisionally deferred to Dec 2, 2027 under the Digital Omnibus agreement of May 2026 — but that deferral is not yet adopted. Until then Aug 2, 2026 is the legally binding date." BrianOnAI: "The AI regulatory landscape has fundamentally shifted from voluntary guidelines to enforceable law. The EU AI Act is now active with penalties reaching 35 million or 7% of global revenue." High-risk categories: hiring, credit, medical, education, critical infrastructure.

GDPR AI compliance requires legal basis documentation, automated decision-making safeguards, DPIAs, and data subject rights. Knowlee: (1) Article 6 legal basis documented for all personal data processing in AI systems. (2) Article 9 special category data requires additional legal basis. (3) Article 22 automated decision-making: AI-influenced decisions with legal or significant effects must be identified. (4) Article 22(2) exceptions documented with legal rationale. (5) Article 22(3) safeguards: right to express point of view, right to contest. (6) Article 35 DPIA mandatory for AI systems with large-scale personal data processing, systematic profiling, or special categories. (7) Article 36 consult supervisory authority if DPIA indicates high residual risk. (8) Serious incident reporting within 72 hours. Neomanex: "GDPR establishes the foundational framework for AI processing of personal data. Key requirements include legal basis, automated decision-making restrictions, and transparency obligations."

How do you map compliance across multiple AI frameworks?

Map compliance across frameworks by running one program mapped intelligently across all regulations. Trustible: "The organizations that manage this well are not running three separate compliance programs. They are running one, mapped intelligently across all three. This guide breaks down the EU AI Act, NIST AI RMF, and ISO 42001, how they compare, where they diverge, and how to satisfy all three without duplicating work." Polygraf: "Compliance is not a checkbox, it is a matrix. An enterprise deploying one AI feature can be subject to EU AI Act, Colorado automated-decision law, California transparency laws, HIPAA or GLBA, and NYC bias-audit law — each with its own trigger, deadline, and penalty schedule." Areebi: "47-point checklist maps controls directly to HIPAA, SOC 2, GDPR, EU AI Act, and NIST AI RMF — enabling CISOs to demonstrate compliance readiness across multiple frameworks from a single policy document." Key: inventory AI systems first, classify by risk tier, then map controls across frameworks.

What are the HIPAA AI compliance requirements for 2026?

HIPAA AI compliance for 2026 requires BAAs, mandatory encryption, MFA, and minimum necessary access controls. Neomanex: "HIPAA 2026: encryption and MFA become mandatory (no longer addressable). Final rule expected by late 2026. Encryption at Rest: Mandatory, AES-256. Encryption in Transit: Mandatory, TLS 1.3+. Multi-Factor Authentication: Mandatory, all PHI access. Vulnerability Scanning: Every 6 months. System Recovery: 72-hour capability. Any AI vendor processing PHI must execute a BAA. Standard AI assistant products do not sign BAAs. If an AI provider will not sign a BAA, you cannot legally process PHI with them." Polygraf: "No AI-specific text in HIPAA: BAA before PHI is sent to an AI vendor, customer financial data (GLBA) protection, and supervision/recordkeeping of AI-assisted communications (FINRA/SEC). Most of the AI obligations that are immediately enforceable are found here." Self-hosted AI models eliminate data sovereignty gaps and remove third-party BAA requirements.

What is ISO 42001 and how does it relate to AI compliance?

ISO/IEC 42001 is the certifiable standard for AI management systems, providing guidelines for establishing, implementing, maintaining, and continually improving AI governance. Guardion: "ISO/IEC 42001 (AI Management System): A certifiable standard that provides guidelines for establishing, implementing, maintaining, and continually improving an AI management system. This ensures that when auditors request evidence of AI oversight, the data is readily available, consistently formatted." Modulos: "EU AI Act and GDPR (binding regulations), ISO/IEC 42001 (international standard), NIST AI RMF (voluntary US framework)." Trustible: "NIST AI RMF defines what governance outcomes to achieve. ISO 42001 defines how to manage an AI management system. The EU AI Act defines what is legally required. Used together, they give organizations a complete picture." Polygraf: "ISO 42001 requires AI system inventory — more than 50% of organizations do not have one. A full inventory of every AI system, its purpose, data, and risk tier is the common first control."

Want a self-hosted AI company brain that does all of this out of the box?
Book a demo →