Consulting, AI Compliance

AI Compliance: Making AI Compliant, and Using AI for Compliance

A practitioner's guide to both sides of AI compliance for healthcare, life sciences, financial services and insurance: the frameworks your AI systems must meet, and the practices that let compliance teams use AI without creating new risk.

AI compliance means two different things. The first is making AI systems meet the rules that apply to them, such as the NIST AI RMF, ISO/IEC 42001, the EU AI Act, HIPAA and bank model risk guidance. The second is using AI inside compliance teams for monitoring, policy mapping and evidence collection. Regulated firms usually need both, and the second creates new systems that are subject to the first.

Book a Discovery Call View Engagement Pricing

two meanings

What AI Compliance Means: Two Problems With One Name

Search for AI compliance and you get two kinds of answer mixed together. Separating them is the first useful step.

Compliance of AI asks whether the AI systems you build, buy or let staff use meet legal, regulatory and contractual requirements. The questions are about data, risk assessment, documentation, human oversight, validation and monitoring. The owner is usually a mix of risk, compliance, privacy, security and the business line that runs the system.

AI for compliance asks whether your compliance function can use AI to do its own work: track regulatory change, map obligations to policies and controls, collect evidence and triage alerts. The owner is the chief compliance officer, and the risk is that the tool becomes an unreviewed decision-maker inside the one team that is supposed to catch those.

AI compliance is also not the same as AI governance. Governance is the operating model: who decides, how systems are inventoried and approved, how risk is tiered. Compliance is meeting specific external requirements. Our page on the difference between AI governance and AI compliance covers that in more detail.

frameworks

AI Regulatory Compliance: The Frameworks That Matter

For US regulated firms, five frameworks come up often. They overlap, so a good AI compliance framework maps evidence once and reuses it.

For banks, our page on model risk management under SR 26-2 covers the current guidance, and our AI model risk management consulting page covers how we help. For health data, see our HIPAA AI compliance requirements guide.

Framework	What it is	What it asks for in practice
NIST AI RMF	A voluntary US risk management framework for AI, organised around Govern, Map, Measure and Manage	A defined AI risk process, context and impact mapping per system, measurement of risks such as bias and robustness, and ongoing management
ISO/IEC 42001	An international, certifiable standard for an AI management system	Policy, roles, risk and impact assessment, controls, internal audit and continual improvement, evidenced for an external auditor
EU AI Act	EU legislation that regulates AI systems by risk category	Classifying each system, then meeting the obligations for its category, which are heaviest for high-risk systems
HIPAA	US rules protecting health information held by covered entities and business associates	Business associate agreements with AI vendors, minimum necessary use of PHI, access control and audit logging
SR 26-2	US bank model risk management guidance, current since April 2026	Model governance, validation and inventory expectations are covered in our SR 26-2 page

ai for compliance

AI for Compliance: How Compliance Teams Use AI

AI in compliance works best on high-volume reading and matching work where a person still makes the call. These are practices that suit AI in compliance work.

Regulatory change monitoring

AI reads new rules, guidance and enforcement actions, summarises what changed and flags which policies and business lines may be affected. A named compliance officer confirms relevance before anything is updated. The value is coverage and speed of first read, not the judgement.

Policy and control mapping

AI drafts a mapping from each obligation to the internal policy, procedure and control that addresses it, and highlights obligations with no mapped control. Reviewers accept or correct each link, and the accepted map becomes the record.

Evidence collection

AI gathers screenshots, logs, approvals and tickets against a control test plan and assembles them for review, with a link back to each source. Evidence it cannot trace to a source is rejected, which keeps the audit file defensible.

Alert and communications triage

In transaction monitoring, surveillance and communications review, AI can rank and summarise alerts so analysts spend time on the ones that matter. Closing or escalating an alert stays a human decision, and the model is itself in scope for model risk review.

choosing a tool

Choosing a Compliance AI Tool

When you evaluate an AI compliance tool, the demo matters less than what happens when an examiner asks how a conclusion was reached.

1. Traceability
Every output links to the source text, record or log it came from.
2. Human approval built in
The tool records who accepted, edited or rejected each AI suggestion, and when.
3. Data handling
A written vendor commitment on retention and on whether your data trains its models, plus a business associate agreement where PHI is involved.
4. Logging and export
Prompts, outputs and decisions are logged and exportable to your own records system.
5. Validation
You can test the tool on your own historical cases before relying on it, and monitor it afterwards.

who for

Who Our AI Compliance Consulting Is For, and Who It Is Not For

It is for compliance, risk and technology leaders at healthcare, life sciences, financial services and insurance organisations who have AI in production or close to it and need to show a regulator, auditor or board that it meets the applicable requirements. It also suits compliance teams that want to adopt AI for their own work and need the controls designed in from the start.

It is not for teams looking for a software licence alone, or for a law firm's opinion. We are not lawyers and do not give legal advice; an AI inventory, assessments and evidence for your counsel and auditors to review can be prepared on request.

engagement

How an AI Compliance Engagement Runs

Every engagement follows the same four steps. An AI system inventory, a prioritised gap list against the frameworks you answer to, and evidence collection set-up can be prepared on request within that scope.

1. Discovery call
We agree which systems, which frameworks and which deadline or audit is driving the work.
2. Scoping
We write down the systems in scope, the frameworks you already answer to and what you need at the end. The engagement is scoped and priced after the discovery call.
3. Delivery in your environment
A senior practitioner who both scopes and delivers works with your team, inside your tools and data boundaries.
4. Handover
Your team runs it from there, or we keep it current through our AI governance and compliance as a service offer.

proof

Assessment Offers and Partner Credentials

We have submitted these assessment offers to Microsoft Marketplace: EU AI Act Compliance Assessment (4–6 Wk Cross-Sector); NIST AI RMF and GenAI Profile Implementation Assessment (4–6 Wk); ISO/IEC 42001 AI Management System Audit Readiness Assessment; and GDPR and DPIA for AI Compliance Assessment (4 to 6 Wk). The ISO/IEC 42001 offer is audit readiness preparation; it is not a certification, which only an accredited certification body can issue.

Our credentials, in each program's exact wording: Claude Partner Network, Select partner · Services Track; OpenAI Partner Network · Select tier; Microsoft: Solutions Partner for Cloud & AI Platforms · Partner ID 7036589; Databricks partner (our listed status is Partner, Active); AWS Marketplace seller. The honest gap: we do not yet have a named, published AI compliance case study. Engagements are scoped and priced after a short discovery call.

Sources

Cited sources

Related resources

Continue exploring

the difference between AI governance and AI compliance AI for compliance teams AI governance and compliance as a service HIPAA AI compliance requirements our AI governance practice AI model risk management consulting model risk management under SR 26-2 governed AI for regulatory reporting how engagements are priced book a discovery call

Straight answers

Frequently asked questions about AI Compliance: Making AI Compliant, and Using AI for Compliance

What is AI compliance?

AI compliance has two meanings. It can mean making sure AI systems meet the laws, regulations, standards and contracts that apply to them, such as HIPAA, the EU AI Act or bank model risk guidance. It can also mean using AI to help a compliance team do its work. Regulated firms usually need both, and AI used for compliance must itself be compliant.

Which AI compliance framework should a US company start with?

Many US firms start with the NIST AI RMF because it is voluntary, flexible and widely understood, then add what their sector or market requires: HIPAA for health data, model risk guidance for banks, the EU AI Act if they place AI on the EU market or use it there, and ISO/IEC 42001 if customers ask for a certifiable management system. Map evidence across them so you collect it once.

Can AI replace compliance analysts?

Not responsibly. AI is good at first reads, summaries, matching obligations to controls and ranking alerts. Decisions about whether a rule applies, whether an alert is suspicious or whether a control passed should stay with a qualified person who is accountable for them. Used that way, AI changes where analysts spend their time rather than removing the judgement.

Is an AI tool used by the compliance team itself subject to compliance rules?

Yes. A tool that helps decide which alerts to escalate or which controls passed influences regulated outcomes, so it belongs in your AI inventory and, in banking, often in model risk scope. It needs validation on your own data, monitoring, logging and documented human approval, the same as any other AI system that affects regulated decisions.

What should we look for in an AI compliance tool?

Look for traceability from every output to its source, built-in recording of human approvals, clear written terms on data retention and model training, exportable logs, and the ability to test it on your own historical cases. A business associate agreement is essential if PHI is involved. Ask how the vendor would support you in front of an examiner.

How is AI compliance different from AI governance?

Governance is the internal operating model for AI: decision rights, inventory, risk tiering, approval and oversight. Compliance is meeting specific external requirements and proving it. Good governance makes compliance far easier, because the inventory, risk assessments and approvals it produces are the evidence your auditors and counsel will want to review. Weak governance usually shows up first as a compliance gap.

How much does AI compliance consulting cost?

It depends on how many systems are in scope, which frameworks apply and whether you need a one-time assessment or ongoing support. Every engagement is scoped and priced after a short discovery call. A short call is the fastest way to a scope.

Talk to the team that would do the work

Bring your requirements to a working session with the person who'll actually deliver.

Book a Discovery Call