Explore our comprehensive resources on behavioral AI monitoring, compliance frameworks, and policy templates.
Start your compliance journey with HAIEC. Free assessment, automated evidence, audit-ready documentation.
Explore compliance frameworks:
Developer tools & integrations:
How AI AppSec uses Semgrep to detect prompt injection sinks, tool abuse, and AI-specific vulnerabilities in source code. 122 detectors, 79 security checks, with code examples.
How @haiec/openai and @haiec/anthropic wrap the official SDKs to capture model usage, token counts, and costs automatically. The instrumentation pattern and privacy considerations.
Learn what AI vendor public security disclosures entail and how they impact AI security and compliance professionals.
AI compliance isn't just for large enterprises. If your small business uses AI for hiring, customer service, or decision-making, you need to understand basic compliance requirements. This guide breaks down complex regulations into actionable steps for resource-constrained teams.
Common misconception: "We're too small to worry about AI regulations."
Reality: Regulations like NYC Local Law 144, California AB 331, and the EU AI Act apply regardless of company size. Penalties don't scale down for small businesses—a $500/day fine hurts a 10-person startup more than a 10,000-person enterprise.
Enforcement risk is real regardless of company size. NYC DCWP has actively enforced Local Law 144 against employers of all sizes, and HIPAA enforcement actions have targeted small clinics and startups alike.
The requirement: Maintain an inventory of all AI systems used in business operations.
Why it matters: You can't comply with regulations you don't know apply to you.
Practical steps:
Example inventory:
Tool: HubSpot AI Email Writer
Purpose: Marketing email generation
Data: Customer emails, engagement history
Decision Impact: Medium (suggests content, human approves)
Compliance Trigger: GDPR (EU customers), CCPA (CA customers)
Key regulations by use case:
Hiring AI:
Customer-facing AI:
Healthcare AI:
Financial AI:
The requirement: Tell people when AI makes decisions about them.
What to disclose:
Sample notice for hiring:
"We use AI to screen resumes for technical skills and experience. You can request human review by emailing hr@company.com. Learn more at company.com/ai-hiring."
Sample notice for customer service:
"This chat uses AI assistance. For human support, type 'agent' or call (555) 123-4567."
Minimum audit frequency:
Budget-friendly audit options:
DIY audit checklist:
What to keep (3 years minimum):
Storage requirements:
HAIEC Free Tier:
Government resources:
What to request from AI vendors:
Red flags:
Phase 1 (Month 1): Discovery
Phase 2 (Months 2-3): Quick Wins
Phase 3 (Months 4-6): Formal Compliance
Phase 4 (Ongoing): Maintenance
What to automate:
ROI of automation:
Why it's costly: Retroactive compliance is 3-5x more expensive than proactive compliance.
The fix: Start compliance before you need it. Even basic documentation helps.
Why it's risky: You're legally responsible, not your vendor.
The fix: Verify vendor compliance claims. Get documentation in writing.
Why it matters: Even chatbots and email tools can trigger compliance requirements.
The fix: Inventory ALL AI, not just obvious systems.
Why it's dangerous: No documentation = no proof of compliance.
The fix: Document everything, even if it seems minor.
DIY Approach: $0-$1,000/year
Automated Platform: $3,000-$7,000/year
Consultant Support: $10,000-$30,000/year
Day 1: AI Inventory
Day 2: Regulation Research
Day 3: Vendor Outreach
Day 4: Notice Creation
Day 5: Documentation Setup
Days 6-7: Team Training
Free tools:
Affordable platforms:
Community support:
AI compliance for small businesses doesn't require a legal team or six-figure budget. Start with the basics: know your AI, understand your obligations, provide transparency, conduct audits, and maintain documentation.
The key is starting now—before you face penalties or complaints. Even small steps toward compliance are better than none.
Ready to start your compliance journey? Get your free AI inventory template →