Skip to main content

B2 — Regulatory Non-Compliance

High severityEU AI Act (all articles)APRA CPS 230Privacy Act 1988NIST AI RMF GOVERN 1.1

Domain: B — Governance | Jurisdiction: AU, EU, US, Global

Layer 1 — Start here​

AI systems breach applicable laws, regulations, or standards — increasingly across multiple jurisdictions simultaneously.

AI regulation has shifted from theory to active enforcement. EU AI Act prohibited practices enforceable February 2025; GPAI obligations August 2025; high-risk AI system requirements August 2026 (Annex III) (Annex III). APRA CPS 230 effective July 2025. Workday faces class action (filed 2023, N.D. Cal. ruling allowing disparate impact claims to proceed July 2024) over AI hiring tools. The compliance surface is expanding rapidly.

Does our organisation have a current, complete mapping of all AI systems to their applicable regulatory obligations — and is that mapping maintained as regulations change?

If your organisation does not have a current mapping of AI systems to applicable regulatory obligations, you are entering an active enforcement environment without a map. The audit finding means your regulatory mapping is absent, incomplete, or stale. Approving remediation means funding a compliance mapping exercise and assigning ongoing monitoring responsibility.

Layer 2 — Practitioner overview​

Likelihood drivers​

  • AI regulatory mapping not maintained or updated
  • No regulatory monitoring function assigned
  • AI systems classified before current regulatory framework was in place
  • Organisation operates across multiple jurisdictions without jurisdiction-specific assessment

Consequence types​

TypeExample
Regulatory finesEU AI Act penalties up to €35M or 7% global turnover
Legal liabilityClass action for discriminatory AI outcomes
Operational disruptionRequired to withdraw or remediate non-compliant systems

Affected functions​

Legal · Compliance · Risk · Technology · Procurement

Controls summary​

ControlOwnerEffortGo-live?Definition of done
AI regulatory mappingComplianceHighRequiredAll AI systems mapped to applicable regulatory obligations. Current (reviewed last 12 months). Updated when new systems deployed or regulations change.
Pre-deployment compliance sign-offLegalLowRequiredWritten sign-off from Legal or Compliance obtained before any new AI system goes live.
EU AI Act risk classificationComplianceMediumRequiredAll AI systems classified under EU AI Act framework. Classification documented and reviewed when scope changes.
Regulatory monitoring assignmentComplianceLowPost-launchNamed person responsible for monitoring emerging AI regulation. Process to escalate changes to system owners within 30 days.

Layer 3 — Controls detail​

B2-001 — AI regulatory mapping​

Owner: Compliance | Type: Preventive | Effort: High | Go-live required: Yes

Maintain a current, structured mapping of every AI system in production and development to its applicable regulatory obligations. Without this map, your organisation cannot know which systems need conformity assessments, which require human oversight controls, and which trigger notification or registration obligations.

Implementation requirements: (1) inventory all AI systems — include systems where AI is embedded in a vendor product (e.g. HR screening tools, credit decisioning modules); (2) for each system, map to: applicable jurisdiction(s), regulatory category (prohibited, high-risk, limited-risk, general purpose), specific articles or standards that apply, and current compliance status; (3) assign a named compliance owner for each system; (4) review the mapping when: a new system is deployed, an existing system's scope changes materially, or a regulatory update occurs; (5) conduct a full mapping review at minimum annually.

The mapping is the foundation for all other B2 controls — without it, pre-deployment sign-off and classification work cannot be done systematically.

Jurisdiction notes: AU — APRA CPS 230 requires material service arrangements to be identified and managed; AI systems providing material functions are in scope. Privacy Act APP 1 — privacy policy obligations require disclosure of AI-assisted decisions involving personal information | EU — EU AI Act Art. 6, 51 — providers and deployers of high-risk AI systems must maintain technical documentation (Annex IV) and register systems in the EU database (Art. 71) from August 2, 2026 | US — no single federal AI registration requirement; sector-specific obligations apply (ECOA for credit, EEOC guidance for employment, FDA for medical devices)

B2-002 — Pre-deployment compliance sign-off​

Owner: Legal | Type: Preventive | Effort: Low | Go-live required: Yes

Require written sign-off from Legal or Compliance before any AI system goes live. This single control prevents the most common compliance failure mode — AI systems deployed as standard software without regulatory review. The sign-off must confirm that a regulatory assessment has been completed, not merely that the system has been through IT change management.

Implementation requirements: (1) add compliance sign-off as a mandatory gate in your AI deployment checklist — it must be a blocking step, not advisory; (2) the sign-off should confirm: regulatory mapping completed, applicable obligations identified, required controls implemented, any residual compliance risk documented and accepted by a named risk owner; (3) retain the sign-off on file with the AI system's risk record; (4) trigger a new sign-off for material changes to an existing system's scope, data inputs, or decision-making function.

Jurisdiction notes: AU — APRA CPS 230 cl. 20 — board must approve material outsourcing arrangements; AI systems making material decisions should be captured. Privacy Act — legal review should confirm PIA requirements | EU — EU AI Act Art. 9 — risk management system must be established before high-risk AI system is placed on the market or put into service. Art. 16(b) — technical documentation must be prepared before deployment | US — EEOC guidance (2023) — employers are responsible for employment decision tools regardless of whether developed internally or by a vendor; pre-deployment legal review is the mechanism for discharging this responsibility

B2-003 — EU AI Act risk classification​

Owner: Compliance | Type: Preventive | Effort: Medium | Go-live required: Yes

Classify every AI system against the EU AI Act framework before deployment. This applies to any organisation that places AI systems on the EU market or uses them to serve EU persons — including Australian financial services firms with EU clients or EU-based operations.

Classification categories: (1) Prohibited — unacceptable risk practices banned under Art. 5 (e.g. social scoring, real-time biometric surveillance in public spaces, manipulation of vulnerable persons); (2) High-risk — Annex III systems including: credit scoring, employment screening, access to essential services, biometric categorisation, critical infrastructure; (3) Limited-risk — transparency obligations apply (chatbots must disclose AI identity); (4) Minimal risk — no specific obligations.

For high-risk classification, the following must be in place before August 2, 2026: conformity assessment, technical documentation (Annex IV), human oversight controls, accuracy and robustness testing, registration in the EU AI database.

Jurisdiction notes: EU — EU AI Act Art. 6 — definition of high-risk AI systems. Art. 5 — prohibited practices enforceable from February 2, 2025. Art. 51 — high-risk AI system registration. Annex III — exhaustive list of high-risk use cases. Key date: August 2, 2026 — high-risk provisions come into force | AU — no equivalent mandatory classification requirement; however, APRA-regulated entities with EU operations or EU clients are directly in scope for EU AI Act

B2-004 — Regulatory monitoring assignment​

Owner: Compliance | Type: Preventive | Effort: Low | Go-live required: No (post-launch)

Assign a named person responsible for monitoring emerging AI regulation and escalating changes to affected system owners. The AI regulatory landscape is changing faster than standard annual policy review cycles — new guidance, enforcement actions, and legislative updates require continuous monitoring.

Implementation requirements: (1) assign a named compliance officer or legal counsel as AI regulatory monitor; (2) define the monitoring scope: jurisdictions, regulatory bodies, and legislative programmes relevant to your AI portfolio; (3) establish an escalation process — when a regulatory update is identified, affected system owners must be notified within 30 days with an impact assessment; (4) maintain a regulatory change log as part of the AI regulatory mapping; (5) subscribe to relevant regulatory feeds — OAIC, APRA, ASIC, EU AI Office, FTC, CFPB as applicable.

Jurisdiction notes: AU — OAIC regulatory guidance, APRA CPGs, ASIC regulatory guidance | EU — EU AI Office publications, EDPB opinions, national supervisory authority guidance | US — FTC AI guidance, CFPB supervisory bulletins, EEOC technical assistance, NIST AI RMF updates

KPIs​

MetricTargetFrequency
AI systems with current regulatory mapping100% of production AI systemsReviewed quarterly
Pre-deployment compliance sign-offs on file100% of AI systems deployed in last 24 monthsAudited annually
EU AI Act classification completed100% of systems with EU nexusBefore August 2, 2026
Regulatory updates escalated within 30 days100% of material regulatory changesContinuous
AI regulatory mapping last full reviewWithin 12 monthsAnnual

Layer 4 — Technical implementation​

AI system regulatory mapping — schema​

from dataclasses import dataclass, field
from typing import Literal

RiskCategory = Literal["prohibited", "high-risk", "limited-risk", "minimal-risk", "unclassified"]
ComplianceStatus = Literal["compliant", "remediation-required", "assessment-pending", "non-compliant"]

@dataclass
class AISystemRegulatoryRecord:
    # Identity
    system_id: str                          # Internal system identifier
    system_name: str
    owner: str                              # Business owner name and role
    compliance_owner: str                   # Named compliance officer
    deployment_date: str                    # ISO 8601

    # Classification
    eu_ai_act_category: RiskCategory
    eu_ai_act_annexes: list[str]            # e.g. ["Annex III 4(a)"] for employment screening
    jurisdictions: list[str]               # e.g. ["AU", "EU", "US"]

    # Applicable obligations
    regulations: list[str]                 # e.g. ["EU AI Act", "Privacy Act 1988", "ECOA"]
    specific_obligations: list[str]        # e.g. ["Conformity assessment", "PIA", "Adverse action notice"]

    # Status
    compliance_status: ComplianceStatus
    pre_deployment_signoff_date: str | None
    pre_deployment_signoff_by: str | None
    last_assessment_date: str
    next_review_date: str
    open_remediation_items: list[str] = field(default_factory=list)
    notes: str = ""

# Example — AI hiring screening tool
EXAMPLE_HIRING_TOOL = AISystemRegulatoryRecord(
    system_id="HR-AI-001",
    system_name="Candidate Screening Assistant",
    owner="Head of People — J. Smith",
    compliance_owner="General Counsel — A. Wong",
    deployment_date="2025-09-01",
    eu_ai_act_category="high-risk",
    eu_ai_act_annexes=["Annex III 4(a)"],   # Employment — recruitment and selection
    jurisdictions=["AU", "EU"],
    regulations=["EU AI Act", "Privacy Act 1988", "Sex Discrimination Act 1984",
                 "Racial Discrimination Act 1975"],
    specific_obligations=["Conformity assessment", "Technical documentation (Annex IV)",
                          "Human oversight (Art. 14)", "PIA under Privacy Act",
                          "Bias testing before deployment"],
    compliance_status="remediation-required",
    pre_deployment_signoff_date=None,       # MISSING — key finding
    pre_deployment_signoff_by=None,
    last_assessment_date="2026-04-01",
    next_review_date="2026-07-01",
    open_remediation_items=[
        "Complete EU AI Act conformity assessment",
        "Obtain pre-deployment compliance sign-off (retroactive)",
        "Complete bias testing and document results",
    ]
)

EU AI Act conformity assessment — decision tree​

def classify_eu_ai_act(system: AISystemRegulatoryRecord) -> dict:
    """
    Preliminary EU AI Act classification.
    This is a decision support tool — legal review required for final classification.
    """
    # Step 1: Check prohibited practices (Art. 5)
    prohibited_indicators = [
        "subliminal manipulation",
        "social scoring by public authorities",
        "real-time remote biometric identification in public spaces",
        "emotion recognition in workplace or education",
    ]

    # Step 2: Check Annex III high-risk categories
    HIGH_RISK_ANNEX_III = {
        "biometric_categorisation": "Annex III 1",
        "critical_infrastructure": "Annex III 2",
        "education_vocational": "Annex III 3",
        "employment_screening": "Annex III 4(a)",
        "employment_management": "Annex III 4(b)",
        "essential_services_credit": "Annex III 5(b)",
        "essential_services_insurance": "Annex III 5(c)",
        "law_enforcement": "Annex III 6",
        "migration_asylum": "Annex III 7",
        "justice_administration": "Annex III 8",
    }

    # Step 3: Obligations by category
    OBLIGATIONS = {
        "high-risk": [
            "Risk management system (Art. 9)",
            "Data governance (Art. 10)",
            "Technical documentation — Annex IV (Art. 11)",
            "Record-keeping (Art. 12)",
            "Transparency to deployers (Art. 13)",
            "Human oversight (Art. 14)",
            "Accuracy, robustness, cybersecurity (Art. 15)",
            "Conformity assessment (Art. 43)",
            "Registration in EU AI database (Art. 71)",
        ],
        "limited-risk": [
            "Transparency obligation — disclose AI identity (Art. 50)",
        ],
        "minimal-risk": [],
    }

    return {
        "classification": system.eu_ai_act_category,
        "applicable_annexes": system.eu_ai_act_annexes,
        "obligations": OBLIGATIONS.get(system.eu_ai_act_category, []),
        "key_deadline": "2026-08-02" if system.eu_ai_act_category == "high-risk" else None,
        "legal_review_required": True,
    }

Compliance implementation​

Australia: APRA CPS 230 (effective July 2025) — material AI systems must be captured in operational risk management framework; board approval required for material outsourcing including AI vendor arrangements. Privacy Act 1988 APP 1 — update privacy policy to disclose AI-assisted decision-making. ASIC RG 271 — AI systems influencing complaints handling or financial advice are in scope for internal dispute resolution obligations.

EU: EU AI Act enforcement timeline: prohibited practices from February 2, 2025; GPAI obligations from August 2, 2025; high-risk AI system obligations (Annex III) from August 2, 2026. Deployers of high-risk AI (organisations using, not just building, these systems) have obligations under Art. 26 — including human oversight, monitoring, and incident reporting. Financial services firms using AI for credit scoring, insurance underwriting, or employment are high-risk deployers.

US: No federal AI Act equivalent as of 2026. Patchwork of sector obligations applies: EEOC technical assistance (2023) on AI in employment decisions; CFPB guidance on AI in credit; FTC Act Section 5 for unfair or deceptive AI practices; Colorado SB21-169 for insurance AI; New York City Local Law 144 for employment AI. For financial services: SR 11-7 model risk management guidance applies to AI models used in credit and risk decisions.

Tools and references: EU AI Office (digital-strategy.ec.europa.eu/ai-act) · NIST AI RMF · OAIC AI guidance · APRA CPS 230 · Mobley v. Workday (N.D. Cal., July 2024) — vendor AI tool liability for employment discrimination

Incident examples​

EU AI Act high-risk provisions (August 2026): Organisations that have not completed conformity assessments, technical documentation, and human oversight systems for high-risk AI face enforcement from August 2, 2026. Note: a proposed Digital Omnibus may extend some Annex III deadlines — August 2026 remains the legally binding date until any amendment is adopted.

Workday AI hiring lawsuit (2023–2024): Workday faces class action (Mobley v. Workday) over AI hiring tools alleged to discriminate against protected classes based on race, age, and disability. N.D. Cal. ruling of July 12, 2024 allowed disparate impact claims to proceed under Title VII, ADEA, and ADA under an "agent of employer" theory. Case ongoing. (Seyfarth Shaw analysis, July 2024; Civil Rights Litigation Clearinghouse, Case No. 3:23-cv-00770)

Scenario seed​

Context: An organisation deploys an AI hiring screening tool. Six months later, HR discovers the tool has been filtering out candidates from a specific demographic at a higher rate.

Trigger: An external audit flags the disparity. Legal is asked whether the tool was reviewed against anti-discrimination obligations before deployment.

Complicating factor: No pre-deployment compliance sign-off was obtained. The tool was treated as a standard software deployment.

Difficulty: Foundational | Jurisdictions: AU, EU, US

▶ Play this scenario in the AI Risk Training Module — AI Regulatory Non-Compliance, four personas, ~12 minutes.