Compliance — SOC 2, HIPAA, GDPR, PCI-DSS, EU AI Act, ISO 42001
Multi-framework coverage is table stakes for 2026 enterprise deals. EU AI Act: in force since August 1, 2024. Most high-risk requirements enforce August 2, 2026. Fines up to €15M or 3% global annual turnover for high-risk-system obligations (Art. 99(4)); up to €35M or 7% for prohibited AI practices (Art. 99(3)). Applies globally if serving EU users. Colorado AI Act: effective June 30, 2026 (delayed from February 2026 by SB25B-004) — impact assessments for high-risk systems, right to appeal AI decisions. Virginia similar for credit/employment/housing/education. SOC 2 Type II: de facto B2B AI requirement (Type II, not Type I, for fintech). GDPR: largest documented AI-specific fine is €30.5M against Clearview AI (Dutch DPA, Sept 2024); Italy's Garante issued €15M against OpenAI in Dec 2024 (later overturned on appeal in March 2026). Real-time PII redaction at inference is the defensible standard; post-processing cleanup is not enough. HIPAA: healthcare bound — cannot send PHI to external AI services without BAA. PCI-DSS: AI-interaction-layer coverage requires configuration + contractual agreements, not automatic. ISO 42001: emerging AI governance standard, growing procurement requirement alongside ISO 27001. Reference profile: OpenAI maintains SOC 2 Type 2, ISO/IEC 27001:2022, ISO/IEC 27701:2019, GDPR/CCPA/HIPAA (BAA)/FERPA, PCI-DSS for ChatGPT payment components. Cross-framework mapping reduces audit fatigue: access controls map across ISO 27001 A.5.15-5.18, GDPR Art. 32, HIPAA §164.312(a). Enumerate the seven 2026 frameworks…
Compliance — SOC 2, HIPAA, GDPR, PCI-DSS, EU AI Act, ISO 42001: Multi-framework coverage is table stakes for 2026 enterprise deals. EU AI Act: in force since…
This free lesson is part of the AI Engineering from Scratch curriculum. Read the full explanation, run the lesson code, and verify the result in the interactive reader or from the repository source.
Browse the complete course catalog or open this lesson on GitHub.