Skip to main content

B2 — Regulatory Non-Compliance

High severityEU AI Act (all articles)APRA CPS 230Privacy Act 1988NIST AI RMF GOVERN 1.1

Domain: B — Governance | Jurisdiction: AU, EU, US, Global

Layer 1 — Start here​

AI systems breach applicable laws, regulations, or standards — increasingly across multiple jurisdictions simultaneously.

AI regulation has shifted from theory to active enforcement. EU AI Act prohibited practices enforceable February 2025; GPAI obligations August 2025; transparency obligations (Art. 50) August 2026; high-risk AI system requirements deferred by the Digital Omnibus (Regulation (EU) 2026/1744) to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). APRA CPS 230 effective July 2025. Workday faces class action (filed 2023, N.D. Cal. ruling allowing disparate impact claims to proceed July 2024) over AI hiring tools. The compliance surface is expanding rapidly.

Does our organisation have a current, complete mapping of all AI systems to their applicable regulatory obligations — and is that mapping maintained as regulations change?

If your organisation does not have a current mapping of AI systems to applicable regulatory obligations, you are entering an active enforcement environment without a map. The audit finding means your regulatory mapping is absent, incomplete, or stale. Approving remediation means funding a compliance mapping exercise and assigning ongoing monitoring responsibility.

Layer 2 — Overview​

Likelihood drivers​

  • AI regulatory mapping not maintained or updated
  • No regulatory monitoring function assigned
  • AI systems classified before current regulatory framework was in place
  • Organisation operates across multiple jurisdictions without jurisdiction-specific assessment

Consequence types​

TypeExample
Regulatory finesEU AI Act penalties up to €35M or 7% global turnover (prohibited practices); €15M or 3% for other breaches (Art. 99)
Legal liabilityClass action for discriminatory AI outcomes
Operational disruptionRequired to withdraw or remediate non-compliant systems

Affected functions​

Legal · Compliance · Risk · Technology · Procurement

Controls summary​

ControlOwnerEffortGo-live?Definition of done
AI regulatory mappingComplianceHighRequiredAll AI systems mapped to applicable regulatory obligations. Current (reviewed last 12 months). Updated when new systems deployed or regulations change.
Pre-deployment compliance sign-offLegalLowRequiredWritten sign-off from Legal or Compliance obtained before any new AI system goes live.
EU AI Act risk classificationComplianceMediumRequiredAll AI systems classified under EU AI Act framework. Classification documented and reviewed when scope changes.
Regulatory monitoring assignmentComplianceLowPost-launchNamed person responsible for monitoring emerging AI regulation. Process to escalate changes to system owners within 30 days.

Layer 3 — Controls detail​

B2-001 — AI regulatory mapping​

Owner: Compliance | Type: Preventive | Effort: High | Go-live required: Yes

Maintain a current, structured mapping of every AI system in production and development to its applicable regulatory obligations. Without this map, your organisation cannot know which systems need conformity assessments, which require human oversight controls, and which trigger notification or registration obligations.

Implementation requirements: (1) inventory all AI systems — include systems where AI is embedded in a vendor product (e.g. HR screening tools, credit decisioning modules); (2) for each system, map to: applicable jurisdiction(s), regulatory category (prohibited, high-risk, limited-risk, general purpose), specific articles or standards that apply, and current compliance status; (3) assign a named compliance owner for each system; (4) review the mapping when: a new system is deployed, an existing system's scope changes materially, or a regulatory update occurs; (5) conduct a full mapping review at minimum annually.

The mapping is the foundation for all other B2 controls — without it, pre-deployment sign-off and classification work cannot be done systematically.

Jurisdiction notes: AU — APRA CPS 230 requires material service arrangements to be identified and managed; AI systems providing material functions are in scope. Privacy Act APP 1 — from 10 December 2026, privacy policies must describe automated decisions (AI or otherwise) that use personal information and could significantly affect individuals' rights or interests (APP 1.7) | EU — EU AI Act Art. 6, 11, 49 — providers and deployers of high-risk AI systems must maintain technical documentation (Annex IV) and register systems in the EU database (Art. 71) — from 2 December 2027 for Annex III systems (deferred from 2 August 2026 by Regulation (EU) 2026/1744) | US — no single federal AI registration requirement; sector-specific obligations apply (ECOA for credit, EEOC guidance for employment, FDA for medical devices)

B2-002 — Pre-deployment compliance sign-off​

Owner: Legal | Type: Preventive | Effort: Low | Go-live required: Yes

Require written sign-off from Legal or Compliance before any AI system goes live. This single control prevents the most common compliance failure mode — AI systems deployed as standard software without regulatory review. The sign-off must confirm that a regulatory assessment has been completed, not merely that the system has been through IT change management.

Implementation requirements: (1) add compliance sign-off as a mandatory gate in your AI deployment checklist — it must be a blocking step, not advisory; (2) the sign-off should confirm: regulatory mapping completed, applicable obligations identified, required controls implemented, any residual compliance risk documented and accepted by a named risk owner; (3) retain the sign-off on file with the AI system's risk record; (4) trigger a new sign-off for material changes to an existing system's scope, data inputs, or decision-making function.

Jurisdiction notes: AU — APRA CPS 230 cl. 20 — board must approve material outsourcing arrangements; AI systems making material decisions should be captured. Privacy Act — legal review should confirm PIA requirements | EU — EU AI Act Art. 9 — risk management system must be established before high-risk AI system is placed on the market or put into service. Art. 16(b) — technical documentation must be prepared before deployment | US — EEOC guidance (2023) — employers are responsible for employment decision tools regardless of whether developed internally or by a vendor; pre-deployment legal review is the mechanism for discharging this responsibility

B2-003 — EU AI Act risk classification​

Owner: Compliance | Type: Preventive | Effort: Medium | Go-live required: Yes

Classify every AI system against the EU AI Act framework before deployment. This applies to any organisation that places AI systems on the EU market or uses them to serve EU persons — including Australian financial services firms with EU clients or EU-based operations.

Classification categories: (1) Prohibited — unacceptable risk practices banned under Art. 5 (e.g. social scoring, real-time biometric surveillance in public spaces, manipulation of vulnerable persons); (2) High-risk — Annex III systems including: credit scoring, employment screening, access to essential services, biometric categorisation, critical infrastructure; (3) Limited-risk — transparency obligations apply (chatbots must disclose AI identity); (4) Minimal risk — no specific obligations.

For high-risk classification, the following must be in place before the high-risk obligations apply — 2 December 2027 for Annex III systems and 2 August 2028 for Annex I (product-safety) systems, under Regulation (EU) 2026/1744: conformity assessment, technical documentation (Annex IV), human oversight controls, accuracy and robustness testing, registration in the EU AI database.

Jurisdiction notes: EU — EU AI Act Art. 6 — definition of high-risk AI systems. Art. 5 — prohibited practices enforceable from 2 February 2025; new bans on AI systems that generate non-consensual intimate imagery or child sexual abuse material apply from 2 December 2026. Art. 49 — high-risk AI system registration (EU database, Art. 71). Annex III — exhaustive list of high-risk use cases. Key dates (Regulation (EU) 2026/1744): 2 December 2027 — Annex III high-risk obligations apply; 2 August 2028 — Annex I high-risk obligations apply | AU — no equivalent mandatory classification requirement; however, APRA-regulated entities with EU operations or EU clients are directly in scope for EU AI Act

B2-004 — Regulatory monitoring assignment​

Owner: Compliance | Type: Preventive | Effort: Low | Go-live required: No (post-launch)

Assign a named person responsible for monitoring emerging AI regulation and escalating changes to affected system owners. The AI regulatory landscape is changing faster than standard annual policy review cycles — new guidance, enforcement actions, and legislative updates require continuous monitoring.

Implementation requirements: (1) assign a named compliance officer or legal counsel as AI regulatory monitor; (2) define the monitoring scope: jurisdictions, regulatory bodies, and legislative programmes relevant to your AI portfolio; (3) establish an escalation process — when a regulatory update is identified, affected system owners must be notified within 30 days with an impact assessment; (4) maintain a regulatory change log as part of the AI regulatory mapping; (5) subscribe to relevant regulatory feeds — OAIC, APRA, ASIC, EU AI Office, FTC, CFPB as applicable.

Jurisdiction notes: AU — OAIC regulatory guidance, APRA CPGs, ASIC regulatory guidance | EU — EU AI Office publications, EDPB opinions, national supervisory authority guidance | US — FTC AI guidance, CFPB supervisory bulletins, EEOC technical assistance, NIST AI RMF updates

KPIs​

MetricTargetFrequency
AI systems with current regulatory mapping100% of production AI systemsReviewed quarterly
Pre-deployment compliance sign-offs on file100% of AI systems deployed in last 24 monthsAudited annually
EU AI Act classification completed100% of systems with EU nexusBefore 2 December 2027 (Annex III)
Regulatory updates escalated within 30 days100% of material regulatory changesContinuous
AI regulatory mapping last full reviewWithin 12 monthsAnnual

Layer 4 — Technical implementation​

AI system regulatory mapping — schema​

from dataclasses import dataclass, field
from typing import Literal

RiskCategory = Literal["prohibited", "high-risk", "limited-risk", "minimal-risk", "unclassified"]
ComplianceStatus = Literal["compliant", "remediation-required", "assessment-pending", "non-compliant"]

@dataclass
class AISystemRegulatoryRecord:
    # Identity
    system_id: str                          # Internal system identifier
    system_name: str
    owner: str                              # Business owner name and role
    compliance_owner: str                   # Named compliance officer
    deployment_date: str                    # ISO 8601

    # Classification
    eu_ai_act_category: RiskCategory
    eu_ai_act_annexes: list[str]            # e.g. ["Annex III 4(a)"] for employment screening
    jurisdictions: list[str]               # e.g. ["AU", "EU", "US"]

    # Applicable obligations
    regulations: list[str]                 # e.g. ["EU AI Act", "Privacy Act 1988", "ECOA"]
    specific_obligations: list[str]        # e.g. ["Conformity assessment", "PIA", "Adverse action notice"]

    # Status
    compliance_status: ComplianceStatus
    pre_deployment_signoff_date: str | None
    pre_deployment_signoff_by: str | None
    last_assessment_date: str
    next_review_date: str
    open_remediation_items: list[str] = field(default_factory=list)
    notes: str = ""

# Example — AI hiring screening tool
EXAMPLE_HIRING_TOOL = AISystemRegulatoryRecord(
    system_id="HR-AI-001",
    system_name="Candidate Screening Assistant",
    owner="Head of People — J. Smith",
    compliance_owner="General Counsel — A. Wong",
    deployment_date="2025-09-01",
    eu_ai_act_category="high-risk",
    eu_ai_act_annexes=["Annex III 4(a)"],   # Employment — recruitment and selection
    jurisdictions=["AU", "EU"],
    regulations=["EU AI Act", "Privacy Act 1988", "Sex Discrimination Act 1984",
                 "Racial Discrimination Act 1975"],
    specific_obligations=["Conformity assessment", "Technical documentation (Annex IV)",
                          "Human oversight (Art. 14)", "PIA under Privacy Act",
                          "Bias testing before deployment"],
    compliance_status="remediation-required",
    pre_deployment_signoff_date=None,       # MISSING — key finding
    pre_deployment_signoff_by=None,
    last_assessment_date="2026-04-01",
    next_review_date="2026-07-01",
    open_remediation_items=[
        "Complete EU AI Act conformity assessment",
        "Obtain pre-deployment compliance sign-off (retroactive)",
        "Complete bias testing and document results",
    ]
)

EU AI Act conformity assessment — decision tree​

def classify_eu_ai_act(system: AISystemRegulatoryRecord) -> dict:
    """
    Preliminary EU AI Act classification.
    This is a decision support tool — legal review required for final classification.
    """
    # Step 1: Check prohibited practices (Art. 5)
    prohibited_indicators = [
        "subliminal manipulation",
        "social scoring by public authorities",
        "real-time remote biometric identification in public spaces",
        "emotion recognition in workplace or education",
    ]

    # Step 2: Check Annex III high-risk categories
    HIGH_RISK_ANNEX_III = {
        "biometric_categorisation": "Annex III 1",
        "critical_infrastructure": "Annex III 2",
        "education_vocational": "Annex III 3",
        "employment_screening": "Annex III 4(a)",
        "employment_management": "Annex III 4(b)",
        "essential_services_credit": "Annex III 5(b)",
        "essential_services_insurance": "Annex III 5(c)",
        "law_enforcement": "Annex III 6",
        "migration_asylum": "Annex III 7",
        "justice_administration": "Annex III 8",
    }

    # Step 3: Obligations by category
    OBLIGATIONS = {
        "high-risk": [
            "Risk management system (Art. 9)",
            "Data governance (Art. 10)",
            "Technical documentation — Annex IV (Art. 11)",
            "Record-keeping (Art. 12)",
            "Transparency to deployers (Art. 13)",
            "Human oversight (Art. 14)",
            "Accuracy, robustness, cybersecurity (Art. 15)",
            "Conformity assessment (Art. 43)",
            "Registration in EU AI database (Art. 49)",
        ],
        "limited-risk": [
            "Transparency obligation — disclose AI identity (Art. 50)",
        ],
        "minimal-risk": [],
    }

    return {
        "classification": system.eu_ai_act_category,
        "applicable_annexes": system.eu_ai_act_annexes,
        "obligations": OBLIGATIONS.get(system.eu_ai_act_category, []),
        "key_deadline": "2027-12-02" if system.eu_ai_act_category == "high-risk" else None,  # Annex III; Annex I: 2028-08-02 (Reg. (EU) 2026/1744)
        "legal_review_required": True,
    }

Compliance implementation​

Australia: APRA CPS 230 (effective July 2025) — material AI systems must be captured in operational risk management framework; board approval required for material outsourcing including AI vendor arrangements. Privacy Act 1988 APP 1 — from 10 December 2026 (new APP 1.7), privacy policies must set out the kinds of personal information used and the kinds of decisions made where a computer program makes, or does something substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests. The duty covers any computer program, not only AI. APRA's letter to industry on AI (30 April 2026) applies existing prudential standards (CPS 220, CPS 230, CPS 234) to AI and sets out observations in four areas: governance (boards still building the AI literacy to challenge AI risk, and over-reliance on vendor presentations and summaries), cyber and information security, supplier risk (dependence on a single AI provider without mapping third- and fourth-party concentration) and change management and assurance (point-in-time, sample-based assurance is ill-suited to AI). ASIC RG 271 — AI systems influencing complaints handling or financial advice are in scope for internal dispute resolution obligations. Looking ahead: on 15 July 2026 the Prime Minister announced mandatory Australian Standards for AI, coordinated by a new Office of AI in the Department of the Prime Minister and Cabinet, with legislation expected in 2027. The measures announced so far centre on large AI data centres (energy and water use) and copyright protections for creators. Until legislation passes, existing law (prudential standards, the Privacy Act, consumer law) is what applies.

EU: EU AI Act enforcement timeline: prohibited practices from 2 February 2025; GPAI obligations from 2 August 2025; transparency obligations (Art. 50) from 2 August 2026; high-risk AI system obligations from 2 December 2027 (Annex III) and 2 August 2028 (Annex I), as deferred by the Digital Omnibus (Regulation (EU) 2026/1744, in force 27 July 2026). Deployers of high-risk AI (organisations using, not just building, these systems) have obligations under Art. 26 — including human oversight, monitoring, and incident reporting. Financial services firms using AI for credit scoring, insurance underwriting, or employment are high-risk deployers.

US: No federal AI Act equivalent as of 2026. Patchwork of sector obligations applies: EEOC technical assistance (2023) on AI in employment decisions; CFPB guidance on AI in credit; FTC Act Section 5 for unfair or deceptive AI practices; Colorado SB21-169 for insurance AI; New York City Local Law 144 for employment AI. For financial services: SR 11-7 model risk management guidance applies to AI models used in credit and risk decisions.

Tools and references: EU AI Office (digital-strategy.ec.europa.eu/ai-act) · NIST AI RMF · OAIC AI guidance · APRA CPS 230 · Mobley v. Workday (N.D. Cal., July 2024) — vendor AI tool liability for employment discrimination

Incident examples​

EU AI Act high-risk deadline deferred (July 2026): The Digital Omnibus on AI (Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026, in force 27 July 2026) deferred the high-risk obligations before they applied: Annex III systems from 2 December 2027 and Annex I systems from 2 August 2028. The new dates are fixed; they are not conditional on harmonised standards being ready. Art. 50 transparency obligations still applied from 2 August 2026. Organisations that have not completed conformity assessments, technical documentation and human oversight systems have a deferral, not an exemption. Source: Regulation (EU) 2026/1744; Council of the EU press release (29 June 2026).

Workday AI hiring lawsuit (2023–2024): Workday faces class action (Mobley v. Workday) over AI hiring tools alleged to discriminate against protected classes based on race, age, and disability. N.D. Cal. ruling of July 12, 2024 allowed disparate impact claims to proceed under Title VII, ADEA, and ADA under an "agent of employer" theory. Case ongoing. (Seyfarth Shaw analysis, July 2024; Civil Rights Litigation Clearinghouse, Case No. 3:23-cv-00770)

Scenario seed​

Context: An organisation deploys an AI hiring screening tool. Six months later, HR discovers the tool has been filtering out candidates from a specific demographic at a higher rate.

Trigger: An external audit flags the disparity. Legal is asked whether the tool was reviewed against anti-discrimination obligations before deployment.

Complicating factor: No pre-deployment compliance sign-off was obtained. The tool was treated as a standard software deployment.

Difficulty: Foundational | Jurisdictions: AU, EU, US