← All posts

Compliance & Regulation

402 posts on compliance & regulation.

EU AI Act Classifier: A Free Tool to Score Your AI System Against Annex III High-Risk Categories

The EU AI Act assigns AI systems to four risk tiers (prohibited, high-risk, limited-risk, minimal-risk). The classification determines which obligations apply and when they take effect. This page walks through the classifier the DeepInspect team built to score your AI system against the Annex III high-risk categories, the supporting articles, and the inputs the classifier needs to produce a defensible verdict.

eu-ai-actclassifierannex-iiicompliancerisk-assessmentfree-tool
Read post →

NIST AI RMF MEASURE Function: The Controls That Produce Auditable Evidence

The NIST AI Risk Management Framework organizes risk management into four functions: GOVERN, MAP, MEASURE, and MANAGE. MEASURE is the function that produces the operational evidence the other three functions depend on. The framework defines four categories under MEASURE, with 18 subcategories that specify what to assess and how to assess it. This article walks each category, the controls a deployer needs in production to satisfy them, the artifacts the controls produce, and where a stateless policy gateway sits in the evidence chain.

nist-ai-rmfcompliancerisk-managementmeasurementauditai-governance
Read post →

Generative AI Governance: The Inspection-Layer Decisions That Sit Between Policy and Production

Generative AI governance has to bind organizational policy to per-request enforcement on the production traffic. The inspection layer between authenticated users or agents and any LLM is where the binding sits. This piece walks through the categories generative AI governance has to decide on, the enforcement placement, the record series, and how the program maps to EU AI Act Article 12 and NIST AI RMF.

generative-ai-governanceai-governanceeu-ai-actnist-ai-rmfinline-enforcement
Read post →

Serious Incident or Malfunction: The Article 73 Trigger That Decides Whether the Clock Starts

The EU AI Act Article 73 reporting obligation hinges on whether an event qualifies as a serious incident under the Article 3(49) definition. Operationally, the difference between a serious incident and an internal malfunction is the difference between a 15-day external reporting clock and an internal incident review. The provider that misclassifies a serious incident as a malfunction has missed the regulatory window. This article walks the Article 3(49) definition, the decision criteria the supervisory authorities apply, the borderline case patterns that recur in enterprise deployments, and the operational record the triage decision requires.

eu-ai-actincident-responsecompliancearticle-73high-risk-airegulation
Read post →

EU AI Act Records of Processing: What the Article 12 + 19 Record Has to Contain Beyond GDPR Article 30

GDPR Article 30 records of processing describe what data the organization processes. EU AI Act Article 12 plus Article 19 records describe what the AI system did with a specific request at a specific moment. The two record series carry different fields at different granularities. This piece walks through the GDPR baseline, the Article 12 plus Article 19 fields, where they sit operationally, and what the audit expects on each.

eu-ai-actrecords-of-processinggdprarticle-12article-19
Read post →

EU AI Act Article 5 Prohibited Practices: The Eight AI Use Cases That Cannot Be Deployed in the EU

EU AI Act Article 5 prohibits eight categories of AI use that the regulation treats as incompatible with Union values. The prohibition has been in force since February 2, 2025. Penalties under Article 99 reach EUR 35 million or 7 percent of global annual turnover, the highest tier in the regulation. Enterprises preparing for the August 2, 2026 high-risk deadline often skip Article 5 because the prohibitions sound like edge cases. The operational reality is that several prohibitions catch mainstream enterprise use cases when the system is examined against the actual statutory text.

eu-ai-actarticle-5prohibited-aicomplianceregulationai-governance
Read post →

The EU AI Act high-risk deadline just moved to December 2027. Here is what still hits on August 2, 2026

The EU Council gave final approval to the Digital Omnibus on AI on June 29, 2026, deferring standalone Annex III high-risk obligations from August 2, 2026 to December 2, 2027. Embedded high-risk systems slide to August 2, 2028. Article 50 transparency obligations still apply on August 2, 2026, and the grace period for AI-content labeling was cut from six to three months, landing on December 2, 2026. A new prohibition on non-consensual intimate imagery generation applies from December 2026. The workstreams a policy gateway supports keep their 2026 deadlines.

eu-ai-actcomplianceregulationai-governanceomnibusaudit
Read post →

EU AI Act GPAI: What General-Purpose AI Model Providers Owe Under Article 51 and the Article 53 Code of Practice

Article 51 sets a separate obligation track for general-purpose AI models. Article 52 lists what counts as systemic-risk GPAI. Article 53 requires the provider to draw up technical documentation and to make information available to downstream providers. The GPAI obligations took effect August 2, 2025, ahead of the high-risk obligations. The Code of Practice published by the AI Office sets the practical compliance roadmap for the most-deployed foundation models in 2026.

eu-ai-actgpaifoundation-modelscomplianceai-governanceregulation
Read post →

EU AI Act Foundation Models: How the Regulation Treats Pre-Training, Fine-Tuning, and Substantial Modification

The EU AI Act does not use the term "foundation model" in its operative text. The regulation treats the underlying systems as general-purpose AI models under Article 51 and triggers systemic-risk obligations at 10^25 training FLOPs under Article 52. Fine-tuning and integration into downstream systems are handled separately by Article 25. The result is a layered obligation set that depends on whether the model is pre-trained, fine-tuned, or repurposed into a high-risk system.

eu-ai-actfoundation-modelsgpaicomplianceai-governanceregulation
Read post →

EU AI Act Foundation Model Provider Obligations: A Reading of Articles 53-56 Before August 2

Articles 53 through 56 of the EU AI Act describe the provider obligations for general-purpose AI models. The obligations take effect August 2, 2026. They cover model documentation, downstream-deployer disclosure, copyright compliance, and additional safety, security, and post-market obligations for systemic-risk models. This article walks through the article-level requirements, the systemic-risk threshold, and the obligations that flow downstream to enterprise deployers that integrate the model.

eu-ai-actfoundation-modelscompliancegpairegulationai-governance
Read post →

EU AI Act for Healthcare: Why AI in Diagnostics, Triage, and Clinical Decision Support Lands in the High-Risk Category

Healthcare AI sits in the high-risk category by two paths. Annex III lists AI used in employment and essential services. The Medical Device Regulation pulls in any AI that meets the definition of a medical device, including most diagnostic and triage tools. The combination means most clinical AI deployments owe both the EU AI Act high-risk obligations and the MDR conformity assessment. The August 2, 2026 deadline applies, and the record-keeping infrastructure most hospitals run today fails the Article 12 test.

eu-ai-acthealthcarecomplianceai-governancemedical-deviceaudit
Read post →

EU AI Act for Fintech: Why Credit Scoring, Fraud Detection, and Insurance Pricing Land in the High-Risk Bucket

Annex III point 5(b) of the EU AI Act puts AI used in evaluating the creditworthiness of natural persons in the high-risk bucket. Annex III point 5(c) puts AI used in life and health insurance pricing in the same bucket. Fraud-detection AI used in retail banking sits in scope where it affects access to essential services. DORA, the Digital Operational Resilience Act, runs in parallel with overlapping log retention and incident reporting obligations. The August 2, 2026 high-risk deadline and the January 17, 2025 DORA effective date are both already binding.

eu-ai-actfintechdoracomplianceai-governanceaudit
Read post →