Before you can tell a client your AI is compliant, you need documented evidence that your system has been assessed against the applicable regulatory framework, that accountability is clearly assigned within your organisation, and that your governance processes are active and verifiable. This applies to any organisation deploying AI in a regulated context, including those subject to the EU AI Act, ISO 42001, or GDPR. The sections below unpack each requirement in practical terms. If you want to talk through your specific situation, feel free to get in touch with us and we will help you further.
What does ‘AI compliant’ actually mean in a client context?
Telling a client your AI is compliant means you can demonstrate, with documented evidence, that your AI system meets the legal, technical, and organisational requirements that apply to your specific use case. It is not a self-declared status. Compliance is a verifiable condition supported by governance structures, risk assessments, and accountability mechanisms that a client or regulator could inspect if needed.
In practice, clients increasingly ask about AI compliance during procurement, contract negotiations, and due diligence processes. They want to know whether your AI system makes decisions that affect them, how those decisions are made, whether the system has been tested for bias or accuracy, and what happens when something goes wrong. A vague assurance that you “take compliance seriously” does not satisfy these questions. What satisfies them is a clear set of documents, roles, and processes that show your governance is operational, not aspirational.
Compliance also varies by context. An AI system used for credit scoring carries different obligations than one used for internal scheduling. The regulatory category your system falls into, the type of data it processes, and the decisions it influences all shape what “compliant” actually requires in your specific situation.
Which regulations apply to your AI system before making compliance claims?
The regulations that apply depend on your AI system’s risk level, the data it processes, and the sector you operate in. For most organisations in the EU in 2026, the relevant frameworks include the EU AI Act, GDPR, and potentially ISO 42001 as a voluntary but increasingly expected standard. Sector-specific rules such as DORA for financial services or NIS2 for critical infrastructure may also apply.
The EU AI Act is the most structurally significant framework for AI-specific compliance. It classifies AI systems by risk level: unacceptable risk systems are prohibited, high-risk systems face strict obligations, and limited or minimal risk systems have lighter requirements. Before making any compliance claim, you need to know which category your system falls into, because the obligations differ substantially.
GDPR and data processing obligations
If your AI system processes personal data, GDPR applies regardless of the AI Act category. This means you need a lawful basis for processing, a data protection impact assessment where relevant, and clear records of data flows. Any AI system that makes automated decisions with significant effects on individuals also triggers specific GDPR rights, including the right to an explanation.
ISO 42001 as a governance benchmark
ISO 42001 is the international standard for AI management systems. While certification is voluntary, it provides a structured framework for demonstrating that your AI governance is systematic and auditable. More clients and partners are beginning to treat ISO 42001 alignment as a baseline expectation, particularly in B2B and enterprise contexts where continuous governance is part of the vendor assessment.
What documentation must be in place before claiming AI compliance?
Before claiming AI compliance, you need a defined set of documents that together prove your governance is active and your system has been properly assessed. At minimum, this includes a risk classification record, a conformity assessment or internal audit report, a data protection impact assessment if personal data is involved, technical documentation of the AI system, and a record of human oversight mechanisms.
The EU AI Act specifically requires high-risk AI systems to maintain technical documentation that covers the system’s intended purpose, design logic, training data characteristics, performance metrics, and risk management measures. This documentation must be kept up to date throughout the system’s lifecycle, not just at the point of deployment.
Beyond the legal minimums, clients often expect to see an incident response procedure that covers AI-specific failures, a record of how the system was tested before deployment, and evidence that staff who operate or oversee the system have received appropriate training. These documents collectively demonstrate that compliance is not a one-time exercise but an ongoing operational commitment, which is precisely what continuous governance means in practice.
One area organisations frequently underestimate is the documentation of human oversight. Regulators and clients want to see that a human can intervene, override, or shut down the AI system when needed, and that this capability is tested and recorded, not just described in a policy document.
Who inside the organisation is responsible for AI compliance sign-off?
AI compliance sign-off must rest with a named individual or role that has both the authority to make governance decisions and the accountability for consequences when something goes wrong. In most organisations, this sits with the Chief Information Security Officer, the Data Protection Officer, or a dedicated AI governance lead, depending on how responsibilities are structured.
The critical point is that accountability must be assigned explicitly, not assumed. Many organisations assume their legal team or IT department “handles compliance” without ever formally assigning ownership. This creates governance gaps that become visible during audits or incidents. Before making a compliance claim to a client, you need a clear internal record showing who reviewed the AI system, who approved the compliance position, and who is responsible for keeping that assessment current.
Management ownership is not optional. Boards and senior leadership carry ultimate responsibility for the organisation’s regulatory posture. In practice, this means that compliance sign-off should involve at least one person with management authority, not only technical or legal staff. This is especially relevant under the EU AI Act, where obligations extend to the deployer organisation as a whole, not just the team that built or procured the system.
How does a third-party audit or certification strengthen the compliance claim?
A third-party audit or certification strengthens a compliance claim because it replaces self-assessment with independent verification. When a qualified external party reviews your AI governance and confirms it meets a recognised standard, clients and regulators have a basis for trust that internal declarations alone cannot provide.
For high-risk AI systems under the EU AI Act, third-party conformity assessments are mandatory before market deployment, not optional. For lower-risk systems, independent audits are not legally required but are increasingly expected in commercial relationships, particularly in sectors where clients conduct their own due diligence or where contractual warranties around compliance are common.
ISO 42001 certification is one of the most practical ways to signal AI governance maturity to clients. The certification process requires you to demonstrate that your AI management system is documented, implemented, and subject to continuous improvement. This directly supports the claim that your governance is operational rather than theoretical. Certification also creates a credible reference point in client conversations: instead of explaining your internal processes in detail, you can point to an independently verified framework.
It is worth noting that certification is not a permanent stamp of approval. It requires ongoing maintenance, which is why aligning your governance model to a 36-month certification cycle, with active monitoring throughout, reflects how real compliance works rather than how it is sometimes sold.
What happens if you claim AI compliance without the governance to back it up?
Claiming AI compliance without the governance to support it exposes your organisation to regulatory enforcement, contractual liability, and reputational damage. If a regulator or client discovers that your compliance claim was made without adequate documentation, risk assessments, or accountability structures, the consequences extend well beyond a failed audit.
Under the EU AI Act, organisations that deploy high-risk AI systems without meeting the required obligations face significant financial penalties. GDPR enforcement for AI systems that process personal data without proper safeguards adds a further layer of risk. Beyond regulatory fines, clients who relied on your compliance claim in a procurement or contracting decision may have grounds for breach of contract if an incident reveals the claim was unsupported.
There is also a practical operational risk that is easy to overlook. Organisations that claim compliance without genuine governance tend to discover their gaps at the worst possible moment: during an incident, a client audit, or a regulatory inspection. At that point, the cost of remediation is far higher than the cost of building proper governance from the start. Governance drift, where compliance structures erode over time because they are not actively maintained, is one of the most common causes of this situation. It rarely happens because of deliberate negligence. It happens because governance was treated as a project with an end date rather than a continuous operational function.
If you want to build a governance structure that genuinely supports the compliance claims you make to clients, we are here to help. Contact us to discuss how we can put the right foundations in place for your organisation. You can also explore our services to see how we approach AI governance as a continuous, managed capability rather than a one-off exercise.
Frequently Asked Questions
How do I know if my AI system qualifies as 'high-risk' under the EU AI Act?
The EU AI Act defines high-risk AI systems based on their intended use case and the potential impact on individuals. Systems used in areas such as credit scoring, employment decisions, biometric identification, education, law enforcement, or critical infrastructure are explicitly listed as high-risk in the Act's annexes. If your system influences decisions that significantly affect a person's rights, opportunities, or safety, you should treat it as potentially high-risk and seek a formal risk classification before making any compliance claims to clients.
What is the difference between being 'GDPR compliant' and being 'AI Act compliant' — do I need both?
Yes, in most cases you need both, and they address different dimensions of your obligations. GDPR governs how personal data is collected, processed, and protected, and it applies whenever your AI system handles personal data regardless of its risk level. The EU AI Act governs the design, deployment, and governance of the AI system itself, focusing on risk management, transparency, and human oversight. A system can have robust data protection practices under GDPR but still fail AI Act requirements if it lacks proper technical documentation, conformity assessments, or human oversight mechanisms.
How long does it typically take to get the documentation and governance in place to legitimately claim AI compliance?
For organisations starting from scratch, building a defensible AI compliance position typically takes between two and six months, depending on the complexity of your AI systems, the number of frameworks that apply, and the maturity of your existing governance structures. The core tasks — risk classification, technical documentation, DPIA completion, accountability assignment, and internal audit — each take meaningful time to do properly. Trying to compress this into a few weeks often results in documentation that looks complete on the surface but does not hold up under scrutiny from a client or regulator.
Can I rely on my AI vendor's compliance documentation to make compliance claims to my own clients?
Only partially. Under the EU AI Act, deployer organisations carry their own compliance obligations that cannot be fully transferred to a vendor. Your vendor's documentation may cover the technical design and testing of the underlying model, but you remain responsible for how the system is deployed in your specific context, how it is monitored, how human oversight is implemented, and how it integrates with your data processing activities. You need to assess and document your own deployment context rather than simply passing on your vendor's compliance materials as if they cover your obligations in full.
What are the most common governance gaps organisations discover during a client audit?
The most frequently exposed gaps are: the absence of a named individual with formal accountability for AI compliance sign-off; technical documentation that was created at deployment but never updated; human oversight mechanisms that exist in policy but have never been tested or recorded in practice; and missing or incomplete data protection impact assessments for AI systems that process personal data. A secondary but increasingly common gap is the lack of an AI-specific incident response procedure — clients and regulators increasingly expect to see how your organisation would detect, contain, and report an AI system failure, not just a general IT incident process.
Is ISO 42001 certification worth pursuing if my organisation is small or early-stage?
ISO 42001 certification is most immediately valuable when your clients are enterprise or public sector organisations that include governance standards in their vendor assessments, or when you are operating in a regulated sector where AI governance scrutiny is increasing. For smaller or earlier-stage organisations, full certification may not be the right first step, but aligning your governance practices to the ISO 42001 framework — even without formal certification — gives you a structured foundation that scales as your client requirements grow. The key benefit is that it forces you to build governance that is systematic and auditable from the start, rather than retrofitting it later when the cost and disruption are significantly higher.
How often should our AI compliance documentation be reviewed and updated?
At a minimum, your AI compliance documentation should be reviewed whenever the system is materially changed, when new data sources are introduced, when the system is deployed in a new context, or when the regulatory landscape changes in a way that affects your obligations. Beyond event-triggered reviews, a scheduled annual review of all core documentation is a practical baseline for most organisations. For high-risk AI systems under the EU AI Act, continuous monitoring is an explicit requirement, not a best practice — which means governance cannot be treated as an annual checkbox exercise but must be an active, ongoing operational function.
Related Articles
- What is the role of governance in managing third-party risk?
- How do you implement continuous governance without slowing operations?
- How do companies move from reacting to compliance pressure to getting ahead of it?
- What is the difference between governance advisory and managed governance?
- How does a governance policy reduce regulatory exposure?