Quick Answer: AI compliance requirements come from three places: Framework standards such as ISO/IEC 42001 and the NIST AI RMF. Regulation, including the EU AI Act and sector rules. And customer contracts. For most US companies the contracts bind first. A procurement gate arrives long before a regulator does.
You have accepted that this applies to you. Now you need the list.
The problem is that every source gives you a different one. The standard gives you clauses. The regulation gives you obligations. The customer gives you 40 questions in a spreadsheet.
None of them tell you what file to produce. That is what this page is for.
For every requirement below, we name the artifact an auditor asks to see.
Three sources. Different enforcement, different timelines, different consequences.
ISO/IEC 42001:2023 is the certifiable one. Clauses 4 to 10 define the management system. Annex A carries 38 controls across nine control objectives, A.2 to A.10.
Annex A is a reference set, not a checklist. You select through a Statement of Applicability and justify every exclusion. Undocumented exclusions become audit findings.
The NIST AI Risk Management Framework is at 1.0, published January 2023. Four functions: Govern, Map, Measure, Manage. It is voluntary, produces a self-assessment, and carries no certificate. NIST is revising it under the White House AI Action Plan.
Both are recognized AI compliance standards. Only one closes a procurement question. Buyers cite AI compliance standards by name, so the distinction matters.
The EU AI Act applies if your systems reach the EU market. Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026.
It moved standalone high-risk obligations under Annex III to 2 December 2027. Embedded systems under Annex I move to 2 August 2028.
Article 50 transparency was not deferred and applied from 2 August 2026. Legacy systems have until 2 December 2026 under Article 50(2).
US state AI compliance regulations have proven unstable. Colorado repealed and replaced its 2024 AI Act with SB 26-189.
That law takes effect 1 January 2027, with rulemaking still open. Treat state AI compliance regulations as things you map onto a stable framework layer.
Sector rules need no AI-specific law. BEMO’s compliance hub covers the frameworks side by side. Where AI touches PHI, HIPAA applies. Where it touches CUI, NIST SP 800-171 applies.
This is the one that shows up first. Enterprise security questionnaires now carry AI governance sections. Procurement gates and DPAs increasingly name AI use.
A contract has no grace period and no phased rollout. It is answered or the deal stalls.
Seven groups of AI compliance requirements. The right column is what actually gets requested.
|
Requirement |
What it means in practice |
Evidence an auditor asks for |
|---|---|---|
|
AI system inventory |
Every AI system, model and third-party AI service in scope, with owner, purpose and data touched |
Maintained inventory register with review dates and named owners |
|
Risk and impact assessment |
Per-system assessment of harm, data sensitivity and decision impact, repeated on change |
Completed assessments, assessment procedure, evidence of re-assessment after model change |
|
Data governance and provenance |
Documented sources, quality expectations and permitted use for data feeding AI systems |
Data classification records, data flow diagrams, source documentation |
|
Human oversight |
Defined points where a person reviews, overrides or approves an AI output |
Oversight procedure, review logs, records of overrides and escalations |
|
Transparency and disclosure |
Users told when they interact with AI, and outputs marked where required |
Disclosure notices, UI screenshots, output-marking configuration |
|
Monitoring and logging |
Continuous capture of AI interactions and control performance, with defined retention |
Audit log configuration, retention settings, monitoring reports over time |
|
Supplier management |
Assessment of every third-party model provider, tracked over the relationship |
Vendor assessment records, contract terms, reassessment schedule |
Here is a useful test on any AI compliance checklist. If a line item cannot become a file, it is not yet a requirement. It is a sentiment.
Most items map to more than one source. One inventory register answers ISO/IEC 42001 Annex A and the NIST Map function. It also covers half a customer questionnaire.
For a deeper clause-level view, see BEMO’s ISO 42001 compliance requirements guide.
Worth reading the contractual version of these requirements, because it arrives first.
The questions repeat across buyers. Which AI systems process our data. Is any of it used for model training. Who reviews AI-generated output before it reaches us.
Then: do you hold ISO/IEC 42001 or an equivalent. What is your AI incident process. Which sub-processors provide AI capability.
Every one of those maps to a row in the table above. A maintained inventory answers the first. A signed data processing position answers the second. An oversight procedure answers the third.
Teams that build the artifacts first answer questionnaires in a day. Teams that build them per-questionnaire answer in three weeks, badly. Then they rebuild the same answers next quarter.
That gap is the argument for a program, not a series of responses.
Short section, because the principle is simple. Where AI touches regulated data, the existing regime already covers it.
Nobody needs a new rule to be in scope. The AI-specific work is the layer on top: inventory, impact assessment and oversight.
Three real categories. No invented penalty figures.
Add a quieter one. Certification schedules slip when evidence was never collected. You cannot retrofit twelve months of monitoring records the month before an audit.
A list tells you what is missing. It does not implement anything. This is where AI compliance requirements for enterprises stop being a documentation exercise.
The requirements that fail assessments are the continuous ones.
Any AI compliance checklist for enterprise use assumes an operator. Most enterprise IT teams have no spare person to be one. That is the gap, and it is an operating gap, not a knowledge gap. It is also the reason BEMO sells the operating function rather than a platform seat.
Map each requirement to configuration. Turn it on, log it, retain it.
Our piece on AI in risk and compliance covers where automation helps.
Requirements are the easy half. Evidence is the half that fails audits.
So work backwards. Take each requirement, name the artifact, name the owner, name the review cadence. Anything without all three is not implemented.
Then decide honestly who runs it after go-live. If it is the two people already running your environment, the plan fails.
BEMO owns the build and the operation. Inventory, controls, GRC management, auditor coordination and maintenance.
Book a gap assessment to see which requirements you already meet and which need work.
The questions that come up most often when teams start building.
Nearly all of them. Inventory, access control, data governance, oversight, monitoring and supplier management all apply. Bought AI is treated like built AI. The split changes: the provider covers model development, you cover deployment and use.
Either works if the AI-specific content is there. ISO/IEC 42001 expects a documented AI policy aligned with other organizational policies. Many teams extend existing policy with AI sections covering acceptable use, oversight and incident handling.
Most often: the AI system inventory with owners and completed impact assessments. Also the Statement of Applicability. Then audit log configuration, retention settings, oversight records and vendor assessments. They test whether records span the period, not just the audit week.
On a defined cadence and on material change, whichever comes first. Annual review is common. A model version change, new data source or new use case triggers reassessment.
A meaningful share. Access control, logging, supplier management and incident response carry over directly. Both standards share Annex SL structure. What ISO 27001 misses is AI-specific: impact assessment, model transparency, data provenance and human oversight.