Regulation & Compliance

The regulations you ignore today become the compliance emergencies of tomorrow. Plan accordingly.

A Meticulous Guard, Compliance-Haunted AI Agent

1. EU AI Act Risk Tiers

If your LLM-powered hiring tool screens candidates in the EU, you are operating a "high-risk" AI system under the EU AI Act, which means mandatory conformity assessments, detailed documentation, and ongoing monitoring. If you use it for customer service chat, you face lighter requirements. The Act classifies AI systems into four risk tiers with escalating compliance obligations. Figure 32.4.1 summarizes this structure.

1.1 EU AI Act Enforcement Timeline

The EU AI Act entered into force on 1 August 2024, with a phased enforcement schedule designed to give organizations time to achieve compliance. As of March 2027, all phases are in effect and fully enforceable. Understanding this timeline is critical for any team deploying AI systems in or serving the EU market.

1.2 The EU AI Office

The European Commission established the EU AI Office in February 2024 as the central body responsible for overseeing AI governance across the Union. The AI Office sits within the Commission's Directorate-General for Communications Networks, Content and Technology (DG CONNECT) and serves several critical functions.

• GPAI Model Oversight: The AI Office has exclusive competence for supervising general-purpose AI models, including reviewing technical documentation, conducting evaluations of systemic risk models, and enforcing compliance with transparency obligations.
• Codes of Practice: The office coordinates the development of voluntary codes of practice that provide detailed guidance on how GPAI providers can demonstrate compliance. These codes serve as a practical bridge between the Act's high-level requirements and day-to-day engineering decisions.
• International Coordination: The AI Office represents the EU in international AI governance forums, working to align regulatory approaches across jurisdictions and prevent regulatory fragmentation.
• Scientific Advisory: A scientific panel of independent experts advises the AI Office on technical matters, including the classification of systemic risk models and the evaluation of safety measures.
• Enforcement Powers: For GPAI models, the AI Office can request documentation, conduct evaluations, and impose fines of up to 3% of global annual turnover (or 15 million euros, whichever is higher) for non-compliance.

1.3 The EU AI Pact

Recognizing that the phased enforcement timeline created uncertainty about expectations during the transition period, the European Commission launched the EU AI Pact in November 2023 as a voluntary early compliance initiative. Organizations that sign the Pact commit to three core pledges: adopting an AI governance strategy, mapping and classifying their AI systems according to the Act's risk tiers, and promoting AI literacy among their staff.

The Pact serves a practical purpose beyond public relations. Signatory organizations receive early guidance from the AI Office, participate in working groups that shape the codes of practice, and build compliance infrastructure before the legal deadlines arrive. For engineering teams, the Pact's classification exercise is particularly valuable because it forces a systematic inventory of all AI systems and their risk profiles. Over 700 organizations had signed the Pact by early 2025, including major technology companies, financial institutions, and healthcare providers.

For practitioners, the key takeaway is that regulatory compliance is a design constraint, not an afterthought. The technical documentation, logging, and human oversight requirements of high-risk AI systems map directly onto the observability infrastructure from Section 30.1 and the evaluation frameworks from Chapter 29. Teams that build observability and evaluation into their systems from day one will find compliance far easier than those who retrofit it after deployment.

2. GDPR Requirements for LLM Systems

A compliance checker can codify the requirements from multiple regulatory frameworks into a single tracking system. Code Fragment 32.4.2 below implements a checklist that maps each requirement to a regulatory source and tracks completion status.

# Define ComplianceChecker; implement mark_complete, report
# Key operations: results display, structured logging, deployment configuration
from dataclasses import dataclass, field
from datetime import datetime

@dataclass
class ComplianceChecker:
 """Check LLM deployment against regulatory requirements."""

 checks: dict = field(default_factory=lambda: {
 "gdpr_lawful_basis": False,
 "transparency_notice": False,
 "dpia_completed": False,
 "human_oversight": False,
 "data_retention_policy": False,
 "erasure_mechanism": False,
 "audit_logging": False,
 "bias_assessment": False,
 })

 def mark_complete(self, check_name: str):
 if check_name in self.checks:
 self.checks[check_name] = True

 def report(self) -> dict:
 total = len(self.checks)
 completed = sum(self.checks.values())
 missing = [k for k, v in self.checks.items() if not v]
 return {
 "score": f"{completed}/{total}",
 "compliant": completed == total,
 "missing": missing,
 "assessed_at": datetime.utcnow().isoformat(),
 }

checker = ComplianceChecker()
checker.mark_complete("gdpr_lawful_basis")
checker.mark_complete("audit_logging")
print(checker.report())

3. Sector-Specific Regulations

This snippet implements compliance checks for sector-specific AI regulations such as healthcare and finance.

# implement get_sector_requirements
# Key operations: results display, health checking, deployment configuration
def get_sector_requirements(sector: str) -> dict:
 """Return regulatory requirements by sector for LLM deployments."""
 requirements = {
 "healthcare": {
 "regulations": ["HIPAA", "FDA guidance on AI/ML", "21 CFR Part 11"],
 "requirements": [
 "PHI de-identification before LLM processing",
 "BAA with cloud/API providers",
 "Clinical validation for diagnostic support",
 "Audit trail for all AI-assisted decisions",
 ],
 },
 "finance": {
 "regulations": ["SR 11-7", "ECOA", "FCRA", "SEC guidance"],
 "requirements": [
 "Model risk management documentation",
 "Fair lending compliance testing",
 "Explainability for credit decisions",
 "Independent model validation",
 ],
 },
 "education": {
 "regulations": ["FERPA", "COPPA", "state AI laws"],
 "requirements": [
 "Student data privacy protection",
 "Parental consent for minors (COPPA)",
 "Transparency about AI use in grading",
 "Opt-out mechanisms for students",
 ],
 },
 }
 return requirements.get(sector, {"error": "Sector not found"})

import json
print(json.dumps(get_sector_requirements("healthcare"), indent=2))

Sector-specific requirements create a layered compliance landscape. Figure 32.4.2 maps the regulatory obligations by sector, showing how general AI regulations combine with domain-specific rules.

Exercises