1 · What AI compliance actually means
Ask a compliance officer what AI compliance means and the answer usually begins with a list of laws. Ask an examiner and the answer is four questions. Which AI systems are running in this organization? What data reaches them? Who decided they could run, and on what terms? Where is the record that shows all of this, and can I check it myself?
Those four questions are the same whether the person asking is a bank examiner working from SR 26-2, a market-conduct examiner working from Section 4 of the NAIC bulletin, a city agency enforcing Local Law 144, or a plaintiff's counsel with a discovery request. The statutes differ in vocabulary and in penalty. The questions underneath them do not.
That is the practical definition this guide uses. AI compliance is the ability to answer those four questions about the AI your organization actually uses, with evidence a stranger can verify, on the day someone asks. A program that can do that is in reasonable shape under the instruments in chapter 3, however its policy binder reads.
Which AI runs?
Answered by · The inventory
What data reaches it?
Answered by · The data findings
Who decided?
Answered by · The approval and policy history
Where is the record?
Answered by · The record itself, with its integrity hash
- Which AI runs? A current inventory of AI systems, the models and vendors behind them, and an owner for each, including the chat assistants staff opened on their own and the AI features that switched themselves on inside software already under license.
- What data reaches it? A record of the categories of personal, nonpublic, or material information that entered prompts and came back in responses, by system, by team, and by provider.
- Who decided? A dated record of the approval, the scope it granted, the policy in force at the time, and the person accountable for the system.
- Where is the record? A retained history of what each system was asked, what it answered, which policy applied, and who reviewed the outcome, kept in a form whose integrity can be verified independently.