AI Regulations & Compliance
What developers need to know about AI regulation: the EU AI Act risk tiers, GDPR for AI, ISO 42001 and the NIST AI RMF — and the engineering practices that keep AI systems compliant.
Intermediate4 min readUpdated
On this page
AI regulation has moved from theoretical to concrete, and developers need a working understanding of it — not to replace legal counsel, but to build systems that can comply. This tutorial surveys the key frameworks and, more usefully, the engineering practices that keep AI systems on the right side of them. It builds on ethical AI & responsible design.
Key Takeaways
- The EU AI Act classifies systems by risk; high-risk uses carry substantial obligations.
- GDPR applies fully to AI processing personal data, with extra rules on automated decisions.
- ISO 42001 and the NIST AI RMF are governance frameworks that structure responsible AI.
- Much of compliance is good engineering: audit logs, bias testing, human oversight, data minimisation.
This is not legal advice
A necessary disclaimer: this is a developer's orientation, not legal guidance. Regulations are complex, jurisdiction-specific and evolving, and your obligations depend on your specific system and market. Involve legal and compliance expertise for real decisions. What this tutorial gives you is enough understanding to build systems that can comply and to know when to ask.
The EU AI Act: risk tiers
The EU AI Act takes a risk-based approach, and it applies to systems used in the EU regardless of where the provider sits:
The tier that catches many developers off guard is high-risk. If your AI is used in recruitment (like résumé screening), credit decisions, or other listed areas, it carries obligations: risk management, data governance, human oversight, transparency, and record-keeping. Building such a system without designing for these from the start is expensive to retrofit.
GDPR for AI
If your AI processes EU residents' personal data, GDPR applies fully:
- Lawful basis — you need one (consent, legitimate interest, contract) for the processing.
- Data minimisation — send the model only the personal data the task needs. This aligns with token discipline and privacy practices.
- Individuals' rights — access, correction, erasure. An AI system holding personal data in prompts, logs or memory must be able to honor these.
- Automated decision-making — decisions that significantly affect people and are made solely by automation carry extra rights, often including a right to human review. This is a direct argument for human-in-the-loop on consequential decisions.
ISO 42001 and NIST AI RMF
Two governance frameworks, increasingly expected in enterprise and regulated contexts:
- ISO 42001 — an international standard for AI management systems, analogous to ISO 27001 for security. It structures how an organisation governs AI development and use, and certification signals a systematic approach.
- NIST AI Risk Management Framework — a voluntary US framework for identifying and managing AI risks across the lifecycle, widely used as a structured approach even outside the US.
Neither is code you write; both shape the processes and documentation around your AI systems.
Compliance is largely good engineering
The encouraging reality: many compliance requirements are practices you should follow anyway.
| Requirement | Engineering practice |
|---|---|
| Accountability, auditability | Audit logging of decisions and reasoning |
| Non-discrimination | Bias testing for disparate impact |
| Human oversight | Human-in-the-loop on consequential decisions |
| Data protection | Data minimisation, retention limits, PII handling |
| Transparency | Disclose AI use; provide reasoning and citations |
| Documentation | Record how the system works, its data, its evaluations |
Build these in and you are most of the way to compliance for many uses — and you have a better system regardless.
A practical compliance posture
For a developer building AI features, a sensible baseline:
- Know your risk tier — is any use high-risk (recruitment, credit, etc.)? If so, engage compliance early.
- Audit everything — log decisions, reasoning and data access immutably.
- Test for bias — on any system making decisions about people.
- Keep humans in the loop — for consequential automated decisions.
- Minimise and protect data — least data, shortest retention, honored rights.
- Be transparent — disclose AI use, provide reasoning.
- Document — how it works, what data it uses, how it was evaluated.
- Involve legal — for anything with real regulatory exposure.
Next
Frequently Asked Questions
What is the EU AI Act and does it affect me?
The EU AI Act is a risk-based regulation that classifies AI systems into tiers — unacceptable (banned), high-risk (heavily regulated), limited-risk (transparency obligations) and minimal-risk. It applies to AI systems used in the EU regardless of where the provider is based, so if your system serves EU users it likely applies. High-risk uses like recruitment, credit and critical infrastructure carry substantial obligations.
How does GDPR apply to AI systems?
AI systems that process personal data are subject to GDPR's full requirements: a lawful basis for processing, data minimisation, purpose limitation, individuals' rights including access and erasure, and rules on automated decision-making that significantly affects people. If your AI processes EU residents' personal data, GDPR compliance is not optional, and automated decisions about people carry extra obligations.
What is ISO 42001?
An international standard for AI management systems — a framework for governing how an organisation develops and uses AI responsibly, analogous to ISO 27001 for information security. Certification demonstrates a systematic approach to AI governance, which is increasingly expected in enterprise and regulated contexts.
What engineering practices help with AI compliance?
Many practices that are simply good engineering also serve compliance: audit logging of decisions, testing for bias, keeping humans in the loop for consequential decisions, data minimisation and retention limits, transparency about AI use, and documentation of how systems work. Building these in from the start is far cheaper than retrofitting them under regulatory pressure.
Related tutorials
- Federated Learning & Privacy-Preserving AIPrivacy-preserving AI techniques for engineers: federated learning, differential privacy, PII redaction, secure processing and the practical patterns for handling sensitive data with LLMs.
- Open Source vs Proprietary AI StrategyChoose an AI model strategy: open-weight vs proprietary hosted models, total cost of ownership, vendor lock-in risk, hybrid approaches and migration paths — a decision framework for Java teams.
- AI Agents for the EnterpriseDeploy AI agents in the enterprise: integrating with SAP, Salesforce and ServiceNow, SSO and identity, audit trails, approval workflows and the governance enterprise agents require.
- Future of AI & Career RoadmapThe Java developer to AI engineer career path: the skills that matter, how to build a portfolio, where the field is heading, and how to keep learning in a fast-moving space.