11 Compliance Frameworks

Choose YourCompliance Framework

Explore how HAIEC can map supported AI-system evidence to relevant laws, voluntary risk frameworks, management-system standards, attestation criteria, and technical guidance. Framework mapping is not certification, and coverage depends on the evaluated scope and available evidence.

Start Assessment Compare Frameworks

Bounded

Evidence mapping

Explicit

Framework class

Visible

Coverage state

Independent

Certification

SOC 2

Trust service criteria for SaaS companies

Demonstrate security, availability, and confidentiality to enterprise customers. Required for B2B SaaS sales.

Medium•3-6 months

Trust Service Criteria (TSC)
Type I & Type II reports
Scheduled monitoring

ISO 27001

International information security standard

Global standard for information security management. Required for international enterprise sales.

High•6-12 months

93 security controls (2022 edition)
Risk assessment framework
Annual certification

GDPR

EU data protection regulation

Mandatory for any company processing EU citizen data. Fines up to €20M or 4% of revenue.

High•3-6 months

Data subject rights
Privacy by design
Data breach notification

EU AI Act

Risk-based AI regulation framework

World's first comprehensive AI law. Mandatory for high-risk AI systems in EU by 2026.

High•6-12 months

Risk classification
Transparency requirements
Human oversight

HIPAA

US healthcare data protection

Required for handling protected health information (PHI). Mandatory for healthcare providers and vendors.

High•3-6 months

PHI protection
Business Associate Agreements
Security Rule compliance

ISO 42001

AI management system standard

First international standard for AI management systems. Demonstrates responsible AI practices.

Medium•4-8 months

AI governance framework
Risk management
Ethical AI practices

NIST CSF

Cybersecurity framework

US government cybersecurity standard. Required for federal contractors and recommended for critical infrastructure.

Medium•3-6 months

Identify, Protect, Detect
Respond, Recover
Risk-based approach

CCPA

California privacy law

California consumer privacy rights. Required for companies doing business in California with 50K+ consumers.

Medium•2-4 months

Consumer rights
Data sale opt-out
Privacy notices

NYC LL144

NYC AI hiring law

Mandatory for AI-powered hiring tools used in NYC. Requires bias audits and transparency.

Medium•1-3 months

Annual bias audit
Public disclosure
Candidate notification

Colorado AI Act

State AI regulation

Colorado's comprehensive AI regulation. Requires impact assessments and risk management for high-risk AI.

Medium•2-4 months

Impact assessments
Risk management
Consumer rights

CSM-6

AI compliance framework

Comprehensive AI compliance framework covering ethics, security, and governance.

Medium•3-6 months

AI ethics framework
Security controls
Governance structure

Not Sure Which Framework You Need?

Take our 2-minute assessment to find out which frameworks apply to your business.

Which Laws Apply?Talk to an Expert

Share this guide: