Regulatory compliance for artificial intelligence stopped being a theoretical matter the day the obligations acquired dates. The EU AI Act has required training for anyone using AI since February 2025, and transparency about that use since August 2026. The GDPR has required you to know where personal data goes since 2018. NIS2 moves accountability to the management body. And ISO 42001 is starting to appear in tenders and procurement processes as a customer requirement.
All of those frameworks ask, at bottom, the same question: can you demonstrate what happened? Complying is not enough. You have to be able to evidence it, with records, dates and names. That is the part generative AI breaks, because the usage happens in one person's browser and leaves no trace in any of the organisation's systems.
The distance between a written policy and demonstrable compliance is exactly the distance between a document and a technical control. An AI use policy that lives on the intranet generates no evidence: it does not show that it is followed, it does not record exceptions and it is no use in an inspection. A control that acts at the moment of sending does produce that trail, and produces it continuously rather than reconstructing it the week before the audit.
There is also a risk specific to this subject that is worth naming: claiming more than you can sustain. A provider that says it is certified against a standard it does not hold, or that promises compliance as an outcome rather than as the customer's own responsibility, creates a bigger problem than it solves. The defensible formulation is always the same: the controls the framework requires are implemented and the evidence to demonstrate them is produced; conformity is what the organisation sustains before its authority.
This category holds the articles on what changes at each date, what actually gets audited and how the evidence is built. For what each individual framework requires, the reference is the regulation section, where each one has its own page.
