AI Governance and Risk · Topic 6 of 6
AI Regulations and Standards
Auditing AI compliance: EU AI Act tiers, provider and deployer duties, Digital Omnibus dates, fines, and ISO/IEC 42001, 23894 and 42005 as audit criteria.
- 6 min
- EU AI Act tiers: unacceptable, high, limited, minimal.
- Providers carry the heaviest duties; deployers oversee, monitor and keep logs.
- Digital Omnibus dates: 2 December 2027 for listed high-risk uses, 2 August 2028 for AI in regulated products.
What it is
AI is now regulated directly by laws such as the EU AI Act, and indirectly by privacy, consumer, employment and sector rules. International standards such as ISO/IEC 42001 give organizations a management system to run AI responsibly and give auditors a structured set of criteria.
The auditor evaluates compliance with legal and regulatory requirements: has the organization identified which laws apply, classified each AI use, mapped duties to controls, and kept evidence? Legal counsel interprets the law; the auditor tests whether the organization acted on that interpretation.
How it works
EU AI Act risk tiers
The EU AI Act (Regulation (EU) 2024/1689) takes a risk-based approach.
| Tier | Examples | Consequence |
|---|---|---|
| Unacceptable risk | Social scoring, harmful manipulation, exploiting vulnerable groups | Prohibited |
| High risk | AI in regulated products; listed uses in areas such as employment, education, credit, critical infrastructure, law enforcement | Strict requirements |
| Limited risk | Chatbots, AI-generated content such as deepfakes | Transparency duties |
| Minimal risk | Spam filters, AI in games | No specific duties |
General-purpose AI models have their own obligations, with more for models that pose systemic risk.
Provider and deployer duties
| Role | Main duties for high-risk AI |
|---|---|
| Provider (develops it or has it developed and places it on the market or puts it into service under its name) | Risk management system, data governance, technical documentation, logging, instructions for use, human oversight design, accuracy, robustness and cybersecurity, quality management system, conformity assessment, post-market monitoring, serious incident reporting |
| Deployer (uses it under its authority in a professional capacity) | Use per instructions, assign competent human oversight, monitor operation, keep the logs it controls, inform workers and their representatives before use at work, and for certain deployers a fundamental rights impact assessment |
A deployer can become a provider by putting its name or trademark on a high-risk system, making a substantial modification to it, or changing the intended purpose of an AI system so that it becomes high-risk. The auditor should check that changes to vendor AI are reviewed for this.
Timeline and penalties
The Act entered into force on 1 August 2024 and applies in stages; prohibitions applied first, from 2 February 2025. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026) moved the high-risk rules to 2 December 2027 for listed high-risk uses and 2 August 2028 for AI in regulated products.
Fines for prohibited practices reach EUR 35 million or 7% of worldwide annual turnover, whichever is higher. Lower ceilings apply to other breaches.
Other laws
| Law type | Why it matters |
|---|---|
| Privacy law, such as GDPR | Lawful basis, impact assessments, limits on solely automated decisions |
| Sector rules | For example banking model risk guidance, medical device and insurance rules |
| Employment and consumer law | Discrimination, unfair practices, disclosure duties |
ISO/IEC standards for AI
| Standard | What it is | Audit use |
|---|---|---|
| ISO/IEC 42001 | Requirements for an AI management system (AIMS); certifiable | Criteria for the whole AI program |
| ISO/IEC 23894 | Guidance on AI risk management, building on ISO 31000 | Criteria for the AI risk process |
| ISO/IEC 42005 (May 2025) | Guidance on AI system impact assessment | Criteria for impact assessment quality |
ISO/IEC 42001 follows the familiar management system structure: context, leadership, planning, support, operation, performance evaluation and improvement. Two artefacts matter to auditors. The statement of applicability lists the necessary controls, says which Annex A controls are included or excluded, and justifies each inclusion and exclusion. The AI system impact assessment records the effects of AI systems on individuals, groups and society.
When reviewing a 42001 certificate, the auditor checks its scope, the certification body, its validity and whether exclusions in the statement of applicability are justified for the AI the organization actually runs.
Terminology and laws outside the EU
ISO/IEC 22989 defines AI concepts and terminology, such as AI system, machine learning and the AI life cycle. It gives auditors and auditees a shared vocabulary, so audit findings use terms both sides read the same way.
AI rules are not only European. Examples include New York City Local Law 144, which requires an independent bias audit before employers use automated employment decision tools, and AI-specific laws or measures adopted in other jurisdictions, such as China's rules on generative AI services. The auditor checks that the organization keeps a register of the AI laws that apply in each place it operates, rather than assuming the EU AI Act is the only one.
An obligations register
Good evidence of compliance is an obligations register: each requirement, the AI systems it applies to, the role the organization plays, the control that meets it, the owner and the evidence. The auditor samples entries and traces each to working controls.
A worked example
A recruitment firm uses a vendor tool that ranks job applicants for EU clients. Employment uses are listed high-risk uses, so the firm is a deployer. The firm has added its own scoring rules and sells the result under its own brand.
The auditor's concern is that the firm may now be a provider, with much heavier duties, and has no conformity evidence. The auditor recommends legal review of the firm's role and, until resolved, documented human oversight of every ranking.
How the exam asks about this
- "What should the auditor do FIRST to assess compliance with AI regulations?" Confirm the organization has identified applicable laws and classified its AI systems against them.
- "Which ISO/IEC 42001 document shows which controls were excluded and why?" The statement of applicability.
- "Under the EU AI Act, what is the maximum fine for prohibited practices?" EUR 35 million or 7% of worldwide annual turnover, whichever is higher.
What to remember for the exam
- EU AI Act tiers: unacceptable, high, limited, minimal.
- Providers carry the heaviest duties; deployers oversee, monitor and keep logs.
- Digital Omnibus dates: 2 December 2027 for listed high-risk uses, 2 August 2028 for AI in regulated products.
- ISO/IEC 42001 is certifiable; 23894 and 42005 are guidance.
- Check certificate scope and statement of applicability exclusions.
A certificate is not a substitute for audit. It shows a management system existed within a scope at a point in time, not that every AI system complies.
Common mistakes
Letting the auditor interpret the law. Legal counsel interprets; the auditor tests whether the organization acted on that advice.
Classifying by technology, not use. The same model can be minimal risk in one use and high risk in another.
Ignoring changes to vendor AI. Rebranding or modifying a high-risk system can shift provider duties onto the organization.
Check yourself
What is a statement of applicability in ISO/IEC 42001?
A document listing the necessary controls, stating which Annex A controls are applied or excluded and justifying each inclusion and exclusion.
What did the Digital Omnibus on AI change?
It moved the EU AI Act high-risk rules to 2 December 2027 for listed uses and 2 August 2028 for AI in regulated products.
How does ISO/IEC 23894 relate to ISO 31000?
It is guidance on AI risk management that builds on the general ISO 31000 risk management principles and process.
Topic 6 of 6 in AI Governance and Risk
Test yourself on AI Governance and Risk
The full ISACA AAIA question bank has 750 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.