L8. AI Compliance: Mapping Controls to Requirements
Course outlineLesson 8 of 21
AI systems must satisfy multiple overlapping regulatory requirements. Rather than building separate control sets for each framework, security architects should map AI controls to requirements once and reuse them across audits.
The Multi-Framework Reality
Most enterprises operating AI systems must satisfy a combination of: sector-specific regulation (HIPAA, FFIEC, FedRAMP), general data protection law (GDPR, CCPA), AI-specific regulation (EU AI Act), and voluntary frameworks their customers require (SOC 2, ISO 27001).
Building separate compliance programs for each is unsustainable. The approach that scales is a unified control library where each control satisfies multiple requirements simultaneously.
Core AI Controls and Their Cross-Framework Mapping
| Control | NIST AI RMF | EU AI Act | ISO 42001 | ISO 27001 |
|---|---|---|---|---|
| AI system inventory and classification | MAP 1.1 | Art. 6 (risk classification) | 6.1.2 | A.8.1 |
| Training data documentation and lineage | MEASURE 2.5 | Annex IV requirements | 8.4 | A.8.3 |
| Human oversight mechanisms | GOVERN 1.2 | Art. 9, 14 | 8.5 | A.6.1 |
| AI incident logging and reporting | MANAGE 4.2 | Art. 73 | 10.2 | A.16.1 |
| Model accuracy and robustness testing | MEASURE 2.6 | Art. 9 (risk management) | 8.4 | A.14.2 |
| Output monitoring in production | MANAGE 2.4 | Art. 72 (post-market monitoring) | 9.1 | A.12.1 |
GDPR-Specific AI Requirements
GDPR applies wherever personal data is processed, including in AI inference. Key obligations:
- Article 22: individuals have the right not to be subject to solely automated decisions with significant effects. If an AI system makes binding decisions about people (hiring, credit, medical), a human review mechanism is required.
- Article 13/14: transparency obligations require disclosing that automated processing occurs and the logic involved.
- Article 35: Data Protection Impact Assessment (DPIA) is mandatory for high-risk processing, including systematic automated processing of personal data at scale.
Building the Unified Control Library
A practical approach:
- Start with your highest-stakes framework (EU AI Act for EU-facing systems; FedRAMP for US federal; HIPAA for healthcare)
- Map each required control to other frameworks to identify overlaps
- Implement each control once with evidence artifacts that satisfy all mapped requirements
- Maintain a control-to-requirement traceability matrix that links each control to its framework citations
This approach reduces audit duplication significantly: the same human oversight procedure satisfies NIST AI RMF GOVERN 1.2, EU AI Act Article 14, and ISO 42001 clause 8.5 simultaneously.
- ✓Build a unified control library: each control should satisfy multiple frameworks simultaneously to avoid duplicated compliance effort
- ✓GDPR Article 22: individuals have the right not to be subject to solely automated decisions with significant effects; human review required
- ✓GDPR Article 35: DPIA is mandatory for high-risk automated processing of personal data at scale; must be completed before deployment
- ✓Control-to-requirement traceability matrix: links each control to all framework citations it satisfies for audit efficiency
- ✓Start with the highest-stakes framework first, then map overlapping controls to secondary frameworks
1. Under GDPR Article 22, when is a human review mechanism required for AI decisions?
2. What is the primary benefit of a control-to-requirement traceability matrix for AI compliance?
Recommended: Pluralsight
Pluralsight's AI security courses cover threat modeling, governance, and practical red teaming for AI systems to complement what you learn here.