Laws and management standards for developing, deploying and using artificial intelligence responsibly. 4 entries, 2 with a full guide.
AI regulation is the fastest-moving area in this directory. The EU AI Act is the first comprehensive AI law. Its prohibitions and AI-literacy duty have applied since February 2025 and its general-purpose AI rules since August 2025. The 2026 Digital Omnibus on AI moved the main high-risk obligations to 2 December 2027 and 2 August 2028.
ISO/IEC 42001 is a voluntary, certifiable AI management system. It does not make you compliant with any law on its own, but it gives you the policies, risk and impact assessments and lifecycle controls that laws and enterprise clients expect. The NIST AI Risk Management Framework is a voluntary US alternative used for structuring AI risk work.
Artificial Intelligence Act, Regulation (EU) 2024/1689, as amended by the Digital Omnibus on AI (2026)
LawMandatory if in scopeEU, extraterritorial
The EU AI Act is the world's first comprehensive AI law. It sorts AI into risk tiers: prohibited practices (banned since February 2025), high-risk systems (strict requirements, now applying from 2 December 2027 and 2 August 2028 after the 2026 Digital Omnibus), limited-risk systems with transparency duties (from August 2026), and minimal risk. General-purpose AI model providers have had obligations since August 2025. It applies to providers and deployers inside and outside the EU, with fines up to EUR 35 million or 7% of turnover.
Covers, who needs it and key requirements
What it covers
AI systems and general-purpose AI models placed on the EU market or used in the EU: prohibited practices, high-risk classification, risk management, data governance, documentation, logging, transparency, human oversight, accuracy and cybersecurity, conformity assessment, post-market monitoring, GPAI duties and penalties.
Who needs it
AI product and SaaS companies selling to EU customers, IT service providers building AI systems for EU clients, and companies deploying AI in hiring, credit, education, healthcare or other high-risk uses.
Why it matters
It applies to non-EU companies, its fines exceed the GDPR's, and EU clients will require AI Act compliance in contracts.
Applies in
European Union; applies extraterritorially to non-EU providers placing AI on the EU market or whose AI output is used in the EU
ISO/IEC 42001:2023 Information technology: Artificial intelligence: Management system (AIMS)
Certifiable standardVoluntaryGlobal
ISO/IEC 42001 is the first international standard for an artificial intelligence management system (AIMS). It helps organisations that develop, provide or use AI systems set AI policy and objectives, assess AI risks and the impact of AI systems on people and society, and control the AI lifecycle through 38 Annex A controls covering data, transparency, human oversight, third parties and responsible use. It follows the same structure as ISO 27001 and is voluntary and certifiable.
Covers, who needs it and key requirements
What it covers
AI policy and roles, AI risk assessment and treatment, AI system impact assessment, data for AI systems, AI lifecycle (design, verification, deployment, monitoring), information for interested parties, third-party and customer relationships, and continual improvement.
Who needs it
AI product companies, SaaS vendors adding AI features, IT service providers building AI solutions for clients, and enterprises deploying AI in decisions that affect people.
Why it matters
Enterprise buyers and regulators want evidence of responsible AI governance, and it gives a recognised, auditable structure aligned with the EU AI Act and the NIST AI RMF.
The NIST AI Risk Management Framework (January 2023) is a voluntary framework for managing risks of AI systems across their lifecycle. It defines characteristics of trustworthy AI and four functions: Govern, Map, Measure and Manage. NIST's Generative AI Profile (NIST AI 600-1, July 2024) applies it to generative AI risks such as confabulation, data privacy and information integrity. It is often used alongside ISO/IEC 42001 and the EU AI Act.
Covers, who needs it and key requirements
What it covers
Trustworthy AI characteristics (valid, reliable, safe, secure, accountable, explainable, privacy-enhanced, fair), and the Govern, Map, Measure and Manage functions.
Who needs it
Organisations developing or deploying AI, especially those selling to US clients or government.
Why it matters
It gives a free, widely recognised structure for AI risk that maps to ISO 42001 and AI laws.
Map: context, intended use and impacts of each AI system
Measure: test and track AI risks and trustworthiness
Manage: prioritise and treat risks and monitor deployed systems
India AI Governance Guidelines
India AI Governance Guidelines (MeitY / IndiaAI Mission, November 2025)
FrameworkVoluntaryIndia
Released by MeitY in November 2025, the India AI Governance Guidelines set out a principle-based, innovation-first approach to AI rather than a new AI law. They propose relying on existing laws such as the IT Act and DPDP Act, voluntary measures and techno-legal tools, and new institutions for coordination. For companies they recommend grievance mechanisms, transparency, risk assessments and voluntary frameworks. Binding duties for AI content currently come from the IT Rules amendments of February 2026.
Covers, who needs it and key requirements
What it covers
Governance principles, institutional framework, risk classification approach, voluntary commitments, techno-legal measures and how existing laws apply to AI.
Who needs it
AI developers and deployers in India, and IT companies building AI products for the Indian market.
Why it matters
It signals how Indian regulators will judge AI governance, and pairs with binding IT Rules duties on synthetic content.
