AI compliance basics: privacy law, sector rules and the EU AI Act
Most AI compliance work comes from three sources: privacy law (GDPR in the EU, India's Digital Personal Data Protection Act 2023, US state laws and others), sector rules (HIPAA for US health data, financial regulators), and AI-specific law, mainly the EU AI Act. For engineers, that translates into design requirements: knowing what data you process, where, for what purpose and for how long, controlling who can access it, logging what the system did, keeping people in the loop where the law requires it, and being able to prove all of it. This page is an overview for engineers, not legal advice, so check the official texts and your legal team.
Why engineers need to know this
Teams build first and ask about compliance at launch, then rebuild the data flow. Most compliance requirements are design requirements: data location, retention, access control, logging and human oversight. They're far cheaper to build in than to add later.
Privacy law
GDPR (European Union)
- A lawful basis for processing personal data, like consent or a contract.
- Data minimisation and purpose limitation: collect only what you need, for a stated purpose.
- Rights for people: access, correction, deletion, objection.
- Rules for transferring data outside the EU, which matter when your model provider is elsewhere.
India's Digital Personal Data Protection Act 2023
The DPDP Rules were notified on 13 November 2025, with a phased rollout:
- Immediately: the Data Protection Board and procedural provisions.
- After 12 months (13 November 2026): consent manager registration requirements.
- After 18 months (13 May 2027): the substantive obligations, including notice and consent, duties of data fiduciaries, children's data, rights of data principals and cross-border transfers.
If you process personal data of people in India, plan for the substantive obligations now.
Others
US state privacy laws (California's CCPA and a growing list of others), and national laws in most countries you'll operate in.
Sector rules
- HIPAA (US health data): protected health information needs specific safeguards, and vendors that handle it, including model providers, need a business associate agreement.
- Financial services: regulators expect model risk management, explainability for decisions and record keeping.
- Legal: professional duties about confidentiality and about the accuracy of what's filed with courts.
EU AI Act
The EU AI Act classifies AI systems by risk, and its timeline changed in 2026 with the AI omnibus, published in the Official Journal on 24 July 2026.
| Date | What applies |
|---|---|
| 1 August 2024 | The Act enters into force |
| 2 February 2025 | Prohibited practices banned, AI literacy duty |
| 2 August 2025 | Obligations for general-purpose AI model providers |
| 2 August 2026 | Transparency duties (Article 50), including marking AI-generated content for new systems, and enforcement powers over general-purpose AI providers |
| 2 December 2026 | Machine-readable marking for systems already on the market before 2 August 2026 |
| 2 December 2027 | High-risk rules for stand-alone systems in Annex III (for example hiring, credit, education, critical services) |
| 2 August 2028 | High-risk rules for AI in regulated products (Annex I) |
High-risk systems need risk management, data governance, technical documentation, logging, human oversight, accuracy, resilience and cybersecurity requirements, and registration. Check the current text for the exact scope, because guidance continues to be published.
Frameworks
- NIST AI Risk Management Framework: a voluntary framework many organisations use to structure AI risk work (govern, map, measure, manage).
- ISO/IEC 42001: a certifiable management system standard for AI.
What to build
For each AI system, a data map:
| Data category | Purpose | Where stored | Processors (including model providers) | Retention | Deletion path | Lawful basis |
|---|
And a named owner, reviewed when the system changes. Together with audit logs and a responsible AI checklist, that covers most of what an auditor will ask first.
From the floor
In the legal LLM project lab, we started with compliance documents before code: a legal boundaries file, a risk register and the metrics, and among the first public sources we pulled were India's Digital Personal Data Protection Act 2023 and the California Consumer Privacy Act, because a legal assistant has to work within the rules it's answering questions about.
In the Neural Vault session, I described these regulatory frameworks, the EU AI Act, HIPAA and GDPR, as fixed rules about how a system should behave, which you can turn into guardrails for your own product, the same way defence work demands absolute air-gap isolation for military data.