AxiReady finds every AI system and agent in use. AxiSentinel controls them, Always On or On Demand, and evaluates them continuously against 220+ frameworks and 940+ obligations in 66+ jurisdictions. A qualified AxiLayer AI auditor signs every finding, so the evidence stays current between audits. Headquartered in Roswell, Georgia, built for enterprises, government agencies and 44 industries.
What is appropriate today may not be appropriate next month. AI threats change daily, and your controls must keep pace. AxiLayer AI works hand in hand with your security team to find, control and evidence your AI. AxiSentinel holds the live controls, gate, hold, contain, stop, and we sign the evidence that they worked, so your AI stays under control and your customers stay protected.
Before deployment: threat assessment, access review, authorized adversarial testing and approval gates. After deployment: live controls, drift and spike detection, threat containment and stop built in, and a re-test after every model, data or vendor change.
For every AI system we show what could go wrong, how exposed you are, what would trigger it, who owns it and how fast you would know. Risk is accepted only by documented decision, never by default.
Every engagement starts from your governance, your data, your vendors and your sector rules, so the controls we test are the ones that matter to you.
Testing only under your written authorization, mapped to the EU AI Act, DORA, NYDFS, NIST, ISO/IEC 27090, ETSI EN 304 223 and MAS, with findings signed by a qualified AxiLayer AI auditor.
One AI incident can reach thousands of customers in minutes. We work alongside your CISO, security operations, risk, compliance and internal audit teams. AxiSentinel works with your security stack, adds live controls for AI systems and agents, and records what each control approved, held, contained or stopped, so you hold signed evidence that the controls work.
Which AI rules apply to you, in which markets, by when, and what evidence will you need? Six free tools answer it for every region of the world, linked to official sources and kept current.
Every AI audit and assessment rule worldwide, with an instant answer for your industry and markets.
Open →94 datesEvery AI compliance date through 2027, in your own calendar with one click.
Open →Q4 2026 editionOur quarterly measure of AI regulation by region, industry and type.
Open →Free 3-minute checkThe evidence your insurer will ask for about AI, and your readiness score.
Open →Buyer checklistHow a qualified AxiLayer AI auditor is trained, held accountable and signs every finding.
Open →FreeCheck any AxiLayer AI record in seconds, without an account.
Open →
MAS, the HKMA and the FSB all issued final AI guidance between 7 and 15 October 2026.
Illinois, California and New York City now write third-party AI audits into statute.
The world's first AI management system standard and its operational implications.
Lawmakers are moving from guidance to mandates, and the mandate is a third-party audit.
Annual third-party audits of large frontier AI developers, with 72-hour incident reporting.
Third-party audits for large companion-chatbot operators, alongside risk assessments and parental controls.
A state registry of AI auditors, with independence standards for the profession.
Annual bias audits of automated hiring tools before they are used on candidates.
We prepare organizations for these duties, with every finding signed by a qualified AxiLayer AI auditor. Talk to our team →
Ten lines, one platform, one ending: a finding signed by a qualified AxiLayer AI auditor. Auditing is one of the ten, not the whole firm. The tenth, Family Safety Assurance, protects the AI children meet on every device.
AxiReady finds every AI system, agent and tool server in use, then scores each one. Systematic identification, classification, and mitigation of AI-related risks. Comprehensive risk matrices, impact assessments, and remediation roadmaps aligned with NIST AI RMF.
Learn MoreRigorous evaluation of algorithmic fairness, transparency, and performance. Testing for bias, accuracy validation, and explainability assessment to ensure responsible AI deployment.
Learn MoreValidation and verification services ensuring AI systems perform as intended. Model validation, output verification, and continuous performance monitoring across production environments.
Learn MoreAxiSentinel gates tools, holds high-impact actions, contains threats and stops agents, Always On or On Demand, and records every decision. Real-time alerts, periodic re-assessments and regulatory update tracking keep the Compliance Passport current.
Learn MoreOne of ten lines, and the one the law names. Audits against the EU AI Act, NIST AI RMF, and ISO/IEC standards, covering algorithm evaluation, data governance, and technical conformity verification, signed by a qualified AxiLayer AI auditor.
Learn MoreCompliance readiness, evidence review and signed findings for the EU AI Act, ISO/IEC 42001, ISO/IEC 23894 and sector frameworks.
Learn MoreStrategic guidance on AI governance, compliance strategy, and regulatory readiness. Expert advisory services for policy development, framework selection, and implementation planning.
Learn MoreComprehensive documentation support including audit reports, compliance matrices, risk registers, and executive summaries for board presentations and regulatory submissions.
Learn MorePolicy development for counties, cities, utilities and state agencies, delivered as an adoption-ready document and machine-checkable obligations, with a signed Procurement Readiness Review.
Learn MoreSecurity and signed evidence for the AI children meet on every device, from chatbots and age signals to cloned-voice scams.
Learn MoreEvery AxiLayer AI engagement follows a structured method mapped to the rules and standards that apply, delivering actionable, defensible results.
Define assessment boundaries, applicable regulatory frameworks, and evidence collection methodology tailored to your AI system's risk classification.
Algorithm evaluation, model and agent testing, data governance review, and cybersecurity assessment using standardized testing protocols, mapped to the OWASP Top 10 for Agentic Applications where agents are in scope.
Systematic risk matrix development, compliance gap identification, and prioritized remediation roadmaps with clear timelines and accountabilities.
Signed assessment reports and the Compliance Passport, detailed audit reports with evidence documentation, and regulatory submission support.
A comprehensive checklist covering all EU AI Act high-risk system requirements and documentation obligations.
Calculate potential fines, reputational costs, and operational savings from proactive AI compliance investments.
Step-by-step guidance for establishing, implementing, and continually improving an AI management system.
AxiLayer AI Inc. is the AI control and assurance company: one platform and ten service lines, worldwide. Established in January 2026 and headquartered in Roswell, Georgia, we find every AI system and agent, control what each agent may do, contain any threat, and sign the evidence that the controls worked.
Our mission is to keep companies and their customers safe as AI agents take on real work, with every conclusion signed by a qualified AxiLayer AI auditor who did not build the system. Compliance with the EU AI Act, NIST AI RMF and ISO/IEC standards comes from the same evidence.
Fees never depend on the result. Findings reflect the evidence.
Current expertise in AI/ML technologies and standards.
Regulatory coverage across six continents.
A signed Compliance Passport that regulators, buyers and boards can verify.
From the first inventory to a signed Compliance Passport, on one platform. Every engagement is scoped to your AI systems and agents, their risk classification, and the frameworks that apply, following a documented method.
We review the AI systems and agents you run, their risk classification, the frameworks that apply and the service lines you need, at no charge.
Every AI system, agent, tool server and identity in use, including shadow AI, in one inventory with a readiness score and the gaps to close.
Gates, holds, threat containment and stop switched on, Always On or On Demand, in your cloud, your data center or air-gapped. Every decision is recorded as evidence.
Algorithm assurance, validation and verification, authorized adversarial testing, and verified corrective action for every gap found.
A qualified AxiLayer AI auditor signs the findings and the Compliance Passport. Regulators, buyers and boards re-verify it free, and it stays current between audits.
Each stage produces evidence your board, procurement teams, regulators, insurers or accredited reviewers can evaluate and re-verify.
Schedule a complimentary consultation with our AI assurance team. We'll find what you run, show you the live controls, identify the frameworks that apply, and outline a clear route to signed evidence.
Every engagement with AxiLayer AI is ultimately a relationship with our leadership team and the professionals they lead. We bring complementary expertise in deep technical architecture, rigorous financial governance, and strategic leadership while working in partnership to deliver consistent, credible outcomes.
AxiLayer AI is headquartered in Roswell, Georgia, with a regional partner based in Hong Kong. Our regulatory map spans 66+ government jurisdictions in 43 countries across six continents. We also track 201 AI audit mandates across 81 countries and 8 regions.
We are the AI control and assurance company. If you want to help secure AI systems, from entry level to experienced auditors, we would like to hear from you.
View Open PositionsAxiLayer AI was established by professionals with extensive, hands-on experience in AI systems architecture, machine learning engineering, and enterprise technology governance. Our founding team brings decades of combined expertise building, deploying, and evaluating AI systems across industries, and recognized, long before regulators codified it, that the field urgently needed an AI assurance company with genuine technical credibility.
Founding Partner and CEO Ovi Pinzaru brings over 15 years of enterprise technology leadership at IBM (Director of Enterprise Architecture) and Hewlett Packard Enterprise (Global People Leader, IT Infrastructure). His career spans Fortune 500 client engagement, enterprise AI governance, and the design of MLOps and LLMOps ecosystems at global scale. That hands-on engineering foundation, combined with Anisa Kimmig's expertise in financial governance and enterprise operations, is what AxiLayer AI brings to every engagement.
AxiLayer AI's leadership depth also includes Alexander Kimmig, Founding Technical Director.
Alex leads the technical methodology behind AxiLayer AI's assessment work, with particular focus on multi-agent architectures, LLM-based agents, tool-using systems, algorithm assurance, and frontier-model evaluation. His empirical research on intent-action divergence in frontier agents and his ConsensusMD work on cross-verification directly reinforce AxiLayer AI's core conviction: assessment produces stronger, more defensible outcomes than single-actor self-attestation.
AxiLayer AI, Inc. is incorporated as a Delaware Corporation, headquartered at 300 Colonial Center Parkway, Roswell, Georgia. Our fees never depend on the result. AxiSentinel acts on each agent. Your authorized people confirm the decisions that matter. A qualified AxiLayer AI auditor who did not build the system signs the result.
AxiSentinel acts on each agent. Your authorized people confirm the decisions that matter. A qualified AxiLayer AI auditor who did not build the system signs the result. Our software, including AxiSentinel, exists to find, control and evidence AI.
That is how our signed findings are built for regulators, procurement officers and boards of directors: every finding links to its evidence, and anyone you choose can re-verify it.
We maintain strict objectivity in every engagement. A qualified AxiLayer AI auditor signs every finding, and our fees never depend on the result. Every finding we produce reflects the evidence, nothing else.
Our leadership team has built and evaluated AI systems from the ground up. We apply the same forensic rigor to algorithmic assessment that financial auditors apply to balance sheets, understanding not just what frameworks require, but how AI systems actually fail in production environments.
AxiLayer AI maps its work to the rules and standards each system must meet, including the EU AI Act, NIST AI RMF and ISO/IEC 42001. Our method, documentation and quality processes are built for the compliance duties of enterprises and government agencies.
A single controls-and-evidence model, mapped to the rules that apply where you operate. A sample of what we cover on each continent:
EU-grade evidence for U.S. federal, state and city rules and Canadian directives
The world's most detailed AI rulebook, plus privacy, cyber and product law
Fast-moving AI laws from Seoul to Hanoi
Risk-based AI laws arriving country by country
Gulf financial-center rules and continental strategies
Government AI policy and automated decision transparency
Governments now measure the AI assurance market and build the profession around it. The UK government's own study shows how fast it is growing. Source
AxiLayer AI is led by three experienced founders, combining deep AI engineering expertise, financial governance and strategic leadership to deliver the technical credibility and discipline that enterprises and government agencies require.
Meet Our TeamTechnology executive with 15+ years at IBM and Hewlett Packard Enterprise. Architect of AxiLayer AI's technical audit methodology.
Financial strategist and operations executive ensuring every AxiLayer AI engagement is delivered to the highest professional standard.
Leads AxiLayer AI's technical methodology for advanced AI assessment, frontier-model evaluation, and multi-agent system assurance.
To establish trust and transparency in artificial intelligence systems through rigorous control, auditing and assessment, enabling organizations worldwide to deploy AI with confidence, accountability, and regulatory assurance.
A world where every AI system that affects people carries current, signed and verifiable evidence that it does what it claims, in every market where it operates.
Fees never depend on the result. A qualified AxiLayer AI auditor who did not build the system signs the result. This is non-negotiable.
Every finding we produce reflects the evidence, nothing else. We do not adjust conclusions to accommodate client preferences or commercial relationships. Our findings and Compliance Passports must be trusted to be valuable.
We apply the highest standards of professional competence to every engagement. Our methodology is rigorous, our documentation is thorough, and our deliverables are actionable.
Every finding links to the evidence behind it. Every record is signed, time-stamped and re-verifiable by regulators, buyers and boards, so trust never depends on taking our word for it.
A qualified AxiLayer AI auditor reviews and signs every finding. Automation accelerates the work; it never finalizes it. A named professional stands behind every result.
AI systems change every day, so assurance cannot be a once-a-year snapshot. Our evidence stays current between audits, Always On or On Demand, configured to how each client operates.
Organizations are deploying AI faster than people are willing to trust it, and regulators everywhere are responding. Trust is no longer earned by promises. It is earned by evidence. That gap is exactly what AxiLayer AI was built to close.
of people worldwide are willing to trust AI systems, across 48,000 people in 47 countries.
KPMG and University of Melbourne, 2025believe AI regulation is required; only 43% think today's laws are adequate.
KPMG and University of Melbourne, 2025documented AI incidents in 2025, up from 233 the year before.
Stanford AI Index 2026of the world's economies will be covered by AI regulation by 2030.
Gartner, Feb 2026AxiLayer AI combines standing, continuous technology and signed human judgment in a single accountable partner. Here is what that means for you.
Fees never depend on the result. AxiSentinel acts on each agent. Your authorized people confirm the decisions that matter. A qualified AxiLayer AI auditor who did not build the system signs the result.
AxiSentinel keeps evidence current between audits, Always On or On Demand. Findings reflect how your AI behaves today, not how it behaved on audit day.
AxiReady finds every AI system in use, including the tools teams adopted on their own. AxiSentinel controls it. A qualified AxiLayer AI auditor signs the result. One unbroken evidence chain from discovery to Compliance Passport.
Every record links to the one before it, and every finding is signed by a qualified AxiLayer AI auditor and delivered as a Compliance Passport anyone can re-verify.
220+ frameworks encoded and 940+ obligations across 66+ government jurisdictions in 43 countries on six continents, from the EU AI Act and NIST AI RMF to DIFC Regulation 10, Singapore, China, India and U.S. state law. One engagement covers every regime that applies. We also track 201 AI audit mandates across 81 countries and 8 regions.
Inside your own cloud tenant or data center, in the Azure region you choose, or fully air-gapped, so data residency rules are met without slowing assurance down.
AxiSentinel runs in your cloud tenant, your data center or fully air-gapped, delivered as a service by AxiLayer AI. Your authorized people confirm the decisions that matter.
SAM.gov registered with CAGE code 20JV1, with air-gapped deployment options and procurement-ready documentation for agencies.
Our founding leadership, with decades of technical, financial and governance experience including 15+ years at IBM and Hewlett Packard Enterprise, stays directly involved in every engagement.
Each principle we hold is now echoed in law, standards or professional rules somewhere in the world. That is why we hold them without exception.
Regulated companies deploying AI in credit, hiring, health, insurance and operations.
Federal, state, city and international public bodies adopting AI under procurement and policy rules.
Companies selling AI into regulated buyers who need evidence, not a vendor summary.
Directors and investors who need decision-grade evidence of AI risk, compliance and accountability.
Talk to our leadership about your AI systems, your obligations and the markets you operate in. Free consultation, no obligation.
Sources: KPMG and the University of Melbourne, Trust, attitudes and use of AI: A global study 2025; Stanford HAI, AI Index Report 2026; Gartner press release, 17 February 2026. Figures as published by each source.
AxiReady™ is where every engagement starts. It finds every AI system, agent, tool server and credential in use, including the ones nobody approved, shows what each can reach and who owns it, and delivers a signed 48-Hour Readiness Report.
Discovery is step one. Everything AxiReady finds, AxiSentinel can control and a qualified AxiLayer AI auditor can prove.
Three layers, one engagement: find what exists, take control of it, and sign the evidence.
Finds every AI system, agent, tool server and credential in use, and reports the gaps in 48 hours. Where every engagement starts.
Gates, holds, contains threats and stops, and records every decision as continuous, evidence-backed compliance.
The AI control and assurance company behind both. Ten service lines, with signed evidence from a qualified AxiLayer AI auditor.
Shadow AI was linked to one in five breaches in IBM’s 2025 study and added about USD 670,000 to the average breach cost. AxiReady gives your security team the AI inventory it needs first: every AI system, tool and connection in use, including the ones teams adopted on their own.
AxiReady answers the first question every security and compliance program asks: what AI do we actually have, and what can it reach? Here is how an engagement runs.
Governance frameworks, RegDef packages, and continuous monitoring all assume the organization already knows which AI systems exist. Most don't, and that gap is exactly where shadow AI, embedded vendor features, and orphaned pilots accumulate unnoticed.
No jurisdiction regulates "AI discovery" as its own category. Instead, a growing set of registration, record-keeping, and certification rules all quietly assume an organization already knows what it operates. AxiReady builds the inventory those rules depend on.
Providers of high-risk and Annex III systems register in the EU database; public-authority deployers submit their own section.
Developers and deployers of covered automated decision-making technology must maintain records and documentation on the systems in scope.
A fast-growing set of state laws layers classification and disclosure duties on top of whatever AI a company already operates, with binding force and scope varying state by state.
The framework's Map function requires establishing context and categorizing AI systems before risk can be measured or managed at all.
Certification bodies expect organizations pursuing the AI management system standard to identify where AI is used as a documented first step.
Most jurisdictions have no binding AI-inventory law today. That is changing quickly, and an inventory built now does not need to be rebuilt when a formal duty arrives.
AI adoption ranges from 9% to 85% depending on the sector, but the governance question is identical everywhere: what exists, who owns it, and what applies to it. Different teams reach that starting point for different reasons; the findings are the same either way.
From the first scan to the signed report, and a clean handoff into control.
Every AI system, agent, tool server, identity and AI-serving container in use, each with an owner and a business function.
Surfaces the AI tools, browser extensions and coding agents teams adopted on their own, alongside procured and embedded AI.
Lists the tool servers, plugins and skills your agents can reach, ready for vetting.
Shows which identity each agent runs under and flags shared credentials. It reads names and metadata, never a secret value.
Maps each system to the risk tiers and frameworks that actually apply to it, not a generic checklist.
A signed report, delivered within two business days of read-only access. The hours are printed on the report, and it is signed only by a qualified AxiLayer AI auditor who did not prepare it.
A standard AI bill of materials for each AI system, plus an agent inventory your teams can export.
Names the three AxiSentinel™ phases to switch on first, based on what was actually found.
Sets out, system by system, the data post-market monitoring will need.
A short self-assessment at first contact that shows where your agents stand and focuses the discovery.
Carries the inventory, tool servers and credential references you choose into AxiSentinel™, evidence intact.
Every finding is reviewed by a person before it reaches you, and reported for your team to act on.
AxiReady reads from the platforms where AI actually shows up, with read-only access. Each one links to more detail.
AxiReady finds and reports. Then AxiSentinel™ and our security services act: gate, hold, contain and stop. Here is what each finding leads to.
Control of AI agents comes first. Auditing is one of ten service lines we provide, alongside everything else you need to run AI safely.
AxiReady tells you what exists and where the gaps are. It does not build, remediate or configure the AI systems it finds, the same rule that governs AxiLayer AI's assurance work: the auditor who signs did not build the system under review.
This boundary also shapes where AxiReady and AxiSentinel sit in the market. AxiSentinel is the control plane: it gates every tool an agent can call, holds high-impact actions for an authorized person, contains threats and stops agents, Always On or On Demand, in your cloud, your data center or air-gapped. What it does not do is build or operate the AI systems it controls, so a qualified AxiLayer AI auditor can sign the evidence that the controls worked, and anyone can re-verify it.
A readiness briefing starts with one question: what AI do you actually have, and what can it reach? AxiReady answers it with signed findings, not assumptions, and hands off cleanly to AxiSentinel™ for whatever you carry forward.
AxiLayer AI, Inc. is the AI control and assurance company: a Delaware corporation, established in January 2026 and headquartered at 300 Colonial Center Parkway, Roswell, Georgia 30076. It is registered on SAM.gov under CAGE code 20JV1.
AxiSentinel acts on each agent. Your authorized people confirm the decisions that matter. A qualified AxiLayer AI auditor who did not build the system signs the result.
AxiReady finds every AI system, agent and tool server in use, then scores each one. Systematic identification, classification, and mitigation of AI-related risks.
Learn MoreRigorous evaluation of algorithmic fairness, transparency, and performance metrics. Bias audits under NYC Local Law 144.
Learn MoreV&V services ensuring AI systems perform as intended across all environments.
Learn MoreAxiSentinel gates tools, holds high-impact actions, contains threats and stops agents, and records every decision.
Learn MoreReadiness review and signed findings for the EU AI Act, ISO/IEC 42001 and sector rules.
Learn MoreStrategic guidance on AI governance, compliance strategy, and regulatory readiness.
Learn MoreComprehensive documentation support including audit reports and compliance matrices.
Learn MorePolicy development for counties, cities, utilities and state agencies, delivered as an adoption-ready document and machine-checkable obligations, with a signed Procurement Readiness Review.
Learn MoreSecurity and signed evidence for the AI children meet on every device, from chatbots and age signals to cloned-voice scams.
Learn MoreAlways On is the simplest place to start: AxiReady discovery in 48 hours, AxiSentinel controls on the systems that matter most, and a qualified AxiLayer AI auditor who signs each month. Point-in-time audits are available as an add-on or a first step. Platform subscription metered by systems and usage, plus assessment projects priced individually. Request a briefing for a scoped proposal.
Authorized attacks on your agents and tools, so you fix weaknesses first.
Learn MoreEvery tool server, plugin and skill vetted and approved before an agent uses it.
Learn MoreA named identity for every agent, with overscoped or stale credentials flagged.
Learn MoreContain one agent or stop the system, with a timed drill that proves how fast.
Learn MoreFind the AI teams adopted on their own, and what it can reach.
Learn MorePlans, drills and clocks for incidents that involve AI agents.
Learn MoreWhen your AI makes or informs decisions for hospitals, insurers, banks or employers, your buyers will ask one question before they sign or renew: who, other than the vendor, has verified this system? AxiLayer AI answers it. We assess your AI products against the rules that apply in every market you sell into, and issue a signed Compliance Passport backed by a signed, re-verifiable evidence chain your buyers can check directly.
Self-attestation opens a negotiation. Evidence closes it, and travels with every deal. When hospitals or enterprise teams validate the signals your AI provides, they need evidence about those signals: accuracy, drift, and whether the product stays within its stated purpose.
Signed evidence packs for EU insurers and banks under DORA, hospital procurement files, and board-ready summaries.
The EU, the UK, the US, the Gulf, Africa, Latin America and Asia Pacific assessed together across 66+ jurisdictions in 43 countries, with in-region deployment where data residency rules require it. We also track 201 AI audit mandates across 81 countries and 8 regions.
Fees never depend on the result. A qualified AxiLayer AI auditor who did not build the system signs the result. Any relationship with a vendor or partner is disclosed and checked before work starts.
An AI system audit is a structured evaluation of an artificial intelligence system against defined compliance requirements, technical standards, or regulatory frameworks. AxiLayer AI conducts these audits through a qualified AxiLayer AI auditor who did not build the system, with fees that never depend on the outcome.
Our audit methodology is modeled on internationally recognized assurance engagement standards, applying the same rigor to AI systems that financial auditors apply to financial statements. Every audit produces a formal audit report with findings, evidence documentation, and signed conclusions suitable for regulatory submission and board-level review.
Around the world, AI audits have moved from voluntary good practice to written requirements. Four examples set the pace.
Every high-risk AI system needs a conformity assessment before it reaches the EU market, backed by a technical documentation file covering design, data governance, risk management, human oversight and logging.
SourceEmployers using automated employment decision tools in New York City must commission an annual bias audit by an outside auditor and publish a summary of the results.
SourceSystems processing personal data in the Dubai International Financial Centre must meet audit and certification requirements, with general certification guidance expected in 2026.
SourceThe Institute of Internal Auditors updated its AI Auditing Framework in September 2024, extending audit expectations to generative AI across governance, management and assurance.
SourceAudit engagements we deliver today, to start with, on their own or combined with AxiReady discovery and AxiSentinel continuous evidence. If it runs on AI, we can audit it: tell us what you run and we will scope it.
Annex IV technical documentation review and an audit file built for the Article 43 conformity route, so high-risk systems are ready for internal control or notified body review.
Gap and pre-certification audits of your AI management system, clause by clause and control by control, with a roadmap to certification.
Assessment across Govern, Map, Measure and Manage, including the Generative AI Profile, with a scored profile and target state.
Bias audits for hiring, lending, insurance and public services, meeting NYC Local Law 144, California's FEHA automated decision rules, Illinois HB 3773, Colorado SB 26-189 and EU AI Act obligations.
Audits of credit, fraud, pricing and capital models against SR 26-2 in the U.S. (which replaced SR 11-7 in April 2026), Canada's OSFI E-23 and the PRA's SS1/23 model risk principles in the UK.
Audits of chatbots, copilots and AI agents for grounding, data leakage, prompt injection, excessive agency and human oversight.
Audits against OMB AI policy, DoD Directive 3000.09, CMMC 2.0 and agency AI use policies, including air-gapped and restricted environments.
Audit evidence collected every day, not once a year, with the Compliance Passport status kept current.
One engagement, mapped across 220+ encoded frameworks and 940+ obligations in 66+ government jurisdictions in 43 countries on six continents. We also track 201 AI audit mandates across 81 countries and 8 regions.
EU AI Act conformity assessment and technical documentation, GDPR, DORA ICT third-party audit rights, NIS2.
PRA SS1/23 model risk management, FCA consumer duty, ICO AI and data protection guidance.
NYC Local Law 144 bias audits, Colorado SB 26-189 (2027), California CPPA and FEHA rules, Texas TRAIGA, SR 26-2, HIPAA, CMMC 2.0, OMB AI policy.
DIFC Regulation 10, Saudi SDAIA AI risk framework, Dubai AI Seal, UAE and Qatar data protection laws.
Singapore AI Verify, MAS guidance and the agentic AI framework, Korea and Taiwan AI Basic Acts, Vietnam's Law on AI, Japan's AI Promotion Act, China's algorithm filing, labeling and personal information compliance audits, China's AI agent Implementation Opinions, MAS SAFR safeguards for AI agents in finance, India's DPDP Rules.
African Union Continental AI Strategy, Kenya and Nigeria national AI strategies, Peru's AI regulation, Brazil's and Chile's AI bills, and data protection laws across both regions.
Confirm the systems in scope, their risk class in each jurisdiction, and the frameworks the audit must cover.
AxiReady inventories the AI estate and AxiSentinel captures live evidence, so fieldwork starts with facts, not questionnaires.
Documentation review, control testing, model and data testing, and interviews with the people who build and run the system.
Every finding is reviewed and signed by a qualified AxiLayer AI auditor, with non-conformities and remediation guidance.
A signed Compliance Passport on success, kept current through continuous monitoring.
Sources: EU AI Act Article 43 and Annex IV; New York City Local Law 144; Mayer Brown on DIFC Regulation 10 (January 2026); The IIA AI Auditing Framework (September 2024 update).
Maximum EU AI Act fine for prohibited AI practices, enforceable since 2 August 2025.
SourcePossible NYC Local Law 144 violations found by New York State auditors, against one found by the city, across the same 32 companies (December 2025).
SourceFines available under Korea's AI Basic Act, in force since 22 January 2026, after a grace period of at least one year.
SourceThe laws, regulations and standards our audits are mapped to, verified as of October 2026. Open a region to see what applies and when.
Every system screened against the banned practices; penalties up to EUR 35M or 7% of turnover. Source
Model documentation, training content summaries and, for systemic-risk models, safety and security evidence. Source
Disclosure of AI interaction and labeling of synthetic content. Source
Annex III high-risk duties from 2 Dec 2027; AI in regulated products from 2 Aug 2028. Source
First harmonized standard for the AI Act, covering the Article 17 quality management system. Source
Vulnerability and incident reporting now; full application 11 Dec 2027. Source
Software and AI are products; audit evidence becomes defense evidence. Source
Safety components with self-evolving machine learning need third-party conformity assessment. Source
Fairness, explainability, oversight and cybersecurity for insurance AI. Source
Machine learning models must be explainable and justify their complexity. Source
New automated decision-making rules and safeguards replace UK GDPR Article 22. Source
13 security principles across five lifecycle phases, built on the UK AI Cyber Security Code of Practice. Source
Planned statutory code on AI and automated decisions; scrutiny of recruitment tools. Source
Second cohort of firms testing AI with the regulator through 2026. Source
No AI bill in the King's Speech; sector regulators lead. Source
Pre-deployment testing, impact assessments and monitoring for high-impact AI; AI contract terms from 30 Sep 2025. Source
Replaces SR 11-7: conceptual soundness, outcomes analysis and ongoing monitoring. Source
National AI policy framework and a DOJ AI Litigation Task Force reviewing state AI laws. Source
Federal AI testing and evaluation infrastructure and a revised NIST AI RMF. Source
Lifecycle performance validation and post-market monitoring for AI medical devices. Source
Annual bias audit by an outside auditor and a published summary; state audit of enforcement in Dec 2025. Source
ADMT duties from 1 Jan 2027; risk assessments by 31 Dec 2027; audit certifications from 1 Apr 2028. Source
Anti-bias testing weighed in discrimination claims; four years of records. Source
Frontier AI frameworks, incident reports and training data disclosures. Source
Bans intentionally discriminatory AI; NIST AI RMF alignment is a defense. Source
No discriminatory AI in employment decisions; notice to workers. Source
Notice, adverse decision explanations, human review and three years of records. Source
Written AI program, internal audit and vendor oversight, adopted across more than 20 U.S. jurisdictions. Source
Model inventory, risk rating and lifecycle validation, including AI and machine learning. Source
Amended: stronger testing, monitoring and Algorithmic Impact Assessment duties. Source
Public sector AI duties to be set by regulation. Source
Transparency for significant automated decisions about individuals. Source
Algorithm filing, security assessments and anti-discrimination duties. Source
Visible labels and metadata labels on AI-generated content. Source
First AI article in national law: ethics and safety oversight. Source
High-impact AI risk management plans, explanations, human oversight and five-year records. Source
High-risk AI warnings and remedy mechanisms. Source
Conformity assessment before deployment for high-risk AI. Source
National AI framework; AI Guidelines for Business call for bias and risk checks. Source
Synthetic content labels; DPDP core duties from 13 May 2027. Source
Risk bounding, human accountability and baseline testing for AI agents. Source
AI inventory, materiality assessment and lifecycle controls for financial institutions. Source
Risk assessment, testing and periodic internal AI audits. Source
Six governance practices; automated decision transparency from 10 Dec 2026. Source
Register of autonomous systems; certification regime anticipated in 2026. Source
Prior approval of AI systems, risk management and an AI register. Source
Consultation on a policy that includes AI testing requirements. Source
Fairness and oversight principles; new federal authority to set standards. Source
Calls for legal frameworks against AI bias and misuse across member states. Source
Ethics, equity and inclusion pillar. Source
National AI direction alongside the Nigeria Data Protection Act. Source
Draft withdrawn in April 2026; revised framework expected. Source
Passed by the Senate; under review in the Chamber of Deputies. Source
High-risk uses, bias prevention, human oversight and three-year records, phased by sector. Source
Risk tiers, risk management and post-market monitoring; now in the Senate. Source
National AI policy and a risk-based bill with impact assessments. Source
Common AI uses in scope, and the rules that apply to each one.
Status labels: In force means obligations apply now; Adopted means enacted with a future start date; Draft or Pending means not yet final; Guidance means supervisory or voluntary expectations. Dates reflect public sources reviewed in October 2026; confirm against official texts before relying on them.
Behind every AxiLayer AI audit engagement sits AxiSentinel™, our own compliance platform. Rather than reconstructing what an AI system did from screenshots and self-attested logs, AxiSentinel intercepts inference events as they happen and evaluates them against the specific regulatory framework that applies, so when our auditors open your file, they are reviewing evidence, not starting from scratch.
The effect on an audit is direct: broader coverage (every event, not a sample), evidence that is timestamped and tamper-evident from the moment it is captured, and a shorter engagement because the evidence base already exists on day one.
AxiSentinel captures a tamper-evident record of every monitored AI decision and evaluate it against the applicable framework. A threshold breach raises a Provisional Alert, a flag for human review, nothing more.
A qualified AxiLayer AI auditor examines the underlying evidence, validates or overrides the alert, and applies a cryptographic signature. This is the step where a machine flag becomes an audit finding.
The signed finding is committed to AxiLayer's cryptographic evidence chain and issued as a Compliance Passport, tamper-evident, traceable, and suitable for regulatory submission and board-level review.
Traditional audits test a sample and infer. AxiSentinel intercepts every AI inference event, so conformity conclusions rest on the full population of decisions rather than a statistical extract.
Every audit record is linked into a signed, tamper-evident evidence chain. Evidence is tamper-evident from capture, not assembled retrospectively for the audit file.
Our proprietary human-oversight measure quantifies actual human oversight of AI decisions as a composite score, direct evidence for EU AI Act Article 14 and equivalent oversight obligations.
RegDef packages translate 940+ obligations across 220+ frameworks, EU AI Act, NIST AI RMF, ISO/IEC 42001 and 23894, Colorado ADMT Act, NYC Local Law 144, SR 26-2, HIPAA, NERC CIP-013, ISO 10218 and more, into machine-executable detection logic that updates as regulations change.
AxiSentinel generates continuous audit evidence in disconnected and air-gapped facilities with no external network connectivity.
The Compliance Passport keeps a live status, CURRENT, UNDER REVIEW or WITHDRAWN, that anyone can check free, so the record reflects the system as it is today, not as it was on audit day.
AxiSentinel is built and owned by AxiLayer AI, and a qualified AxiLayer AI auditor who did not build the system under review signs every finding.
Algorithmic assurance addresses one of the most technically complex challenges in AI compliance: demonstrating that an algorithm is fair, transparent, accurate, and free from harmful bias. AxiLayer AI's algorithm assurance services combine statistical analysis, model interpretability techniques, and regulatory framework requirements to deliver comprehensive algorithmic evaluation.
Our team applies current best practices in algorithmic fairness research alongside regulatory requirements under the EU AI Act's non-discrimination provisions, NIST AI RMF bias testing protocols, NYC Local Law 144 third-party bias audit requirements, and sector-specific requirements in healthcare, financial services, and government AI applications.
AxiLayer AI, Inc. prepares and carries out bias audit work for NYC Local Law 144. The law requires an auditor with no financial interest in the audited tool, and we check eligibility for each engagement before work starts. No DCWP pre-approval is required or available.
Our LL 144 bias audit methodology includes statistical analysis of selection rates and scoring distributions across demographic categories for automated employment decision tools (AEDTs), consistent with the requirements of the law and its implementing rules.
Fairness and explainability have moved from research topics to legal tests on several continents. Four developments set the pace.
The AI Omnibus created a legal basis to process special categories of personal data for bias detection and correction, only where strictly necessary and under strict safeguards on access, security and deletion.
SourceSince 1 October 2025, the quality, efficacy, recency and scope of anti-bias testing can be weighed in discrimination claims, automated decision records must be kept four years, and vendors can share liability.
SourceIn February 2025 the Court held that people subject to automated decisions are owed a meaningful explanation of the procedure and principles actually applied, not just the algorithm itself.
SourcePublished in January 2025, it calls for a documented bias profile across the full lifecycle, early stakeholder identification and continuous monitoring for data and concept drift.
SourceEight algorithm assurance services, delivered on their own or combined with AxiReady discovery and AxiSentinel continuous evidence.
Group and intersectional fairness testing across protected characteristics, with disparate impact, equalized odds, calibration and impact ratio analysis.
NYC Local Law 144 audits plus testing for California's FEHA automated decision rules, Illinois, Colorado SB 26-189 and EU AI Act employment use cases.
Fair lending and insurance unfair discrimination testing, including searches for less discriminatory alternative models.
SHAP, LIME and counterfactual explanations tested for whether they give people a meaningful, accurate account of the decision, as GDPR and the CJEU now expect.
Stereotype, representational and allocation harm testing for chatbots, copilots and agents, across languages and user groups.
Accuracy, subgroup performance gaps, adversarial and edge case testing, and distribution shift analysis.
Dataset quality and representativeness review under EU AI Act Article 10, with Article 4a safeguards for any special category data used to de-bias.
AxiSentinel tracks fairness and performance metrics in production and keeps an IEEE 7003-style bias profile current between audits.
The tests are chosen for each system, its decision and the law that governs it.
Fairness and explanation rules mapped across 220+ encoded frameworks and 940+ obligations in 66+ government jurisdictions in 43 countries on six continents. We also track 201 AI audit mandates across 81 countries and 8 regions.
AI Act Articles 10 and 4a, GDPR Article 22 and the C-203/22 explanation standard, EU equal treatment law.
Equality Act 2010, ICO guidance on AI and fairness, Data (Use and Access) Act automated decision safeguards, FCA consumer duty.
NYC Local Law 144, California FEHA automated decision rules, Illinois Human Rights Act AI amendments, Colorado SB 26-189, U.S. fair lending law, Canada.
DIFC Regulation 10, Saudi SDAIA AI ethics principles on fairness, UAE AI ethics guidelines, regional data protection laws.
Singapore AI Verify and MAS FEAT principles, Korea and Taiwan AI Basic Acts, China's algorithm recommendation and generative AI rules, Japan's AI Guidelines for Business, India's DPDP Rules, Hong Kong's PCPD AI framework, Australia's automated decision transparency rules.
Automated decision rights under Brazil's LGPD, South Africa's POPIA and Kenya's Data Protection Act, plus Peru's AI regulation, Brazil's and Chile's AI bills, and the African Union Continental AI Strategy.
Define the decision, the people affected and the legal tests that apply in each market.
Check training and production data for representativeness, proxies and label bias.
Run fairness, explainability, robustness and performance tests on the live model.
Quantify disparities and test less discriminatory alternatives before sign-off.
A qualified AxiLayer AI auditor signs the result; AxiSentinel keeps watching.
Full findings, plus a publishable summary where the law requires one.
Every metric by group and intersection, with thresholds explained.
How the model decides, and whether explanations hold up.
Transparency documentation ready for regulators and buyers.
Prioritized fixes, with the effect of each on fairness and accuracy.
A living record of bias decisions across the lifecycle.
Sources: DLA Piper on the AI Omnibus and Article 4a (2026); McDermott Will & Schulte on California's FEHA automated decision rules (October 2025); Court of Justice of the EU press release on Case C-203/22 (February 2025); DLA Piper on IEEE 7003-2024 (January 2025).
We first confirm a system does not fall into a banned category. If it does, no fairness score can fix it.
Fines up to EUR 35M or 7% of worldwide turnover. Source
Disparate impact alone does not prove intent, so testing evidence matters. Source
Algorithm filing and security assessments apply. Source
Employers must also give notice when AI is used. Source
What each market expects from bias testing and explanations, verified as of October 2026.
Twelve decisions where unfair outcomes most often appear, and the first test we run on each.
Impact ratios, intersectional selection rates
Disparate impact, less discriminatory alternatives
Proxy discrimination, outcome testing
Subgroup accuracy and calibration
Adverse action fairness, data proxies
Error-rate gaps across student groups
False positive rates by group
Demographic error differentials
Delivery skew, differential pricing
Stereotype and representational harm
Over- and under-enforcement by language
Disparate effects on shifts and pay
Status and dates reflect public sources reviewed in October 2026; confirm against official texts before relying on them.
AI risk assessment is the foundation of every compliance program. AxiLayer AI's risk assessment services provide organizations with a comprehensive, documented understanding of their AI system's risks across technical, operational, legal, and ethical dimensions, aligned with the leading global risk management frameworks.
distinct AI risks catalogued across 74 frameworks in the MIT AI Risk Repository (December 2025). No organization can track them by hand. AxiLayer AI maps the ones that apply to you.
MIT AI Risk RepositoryRisk assessment has moved from good practice to legal obligation. These four requirements define what regulators and buyers now expect.
Providers of high-risk AI must run a documented risk management system across the whole lifecycle: identify, estimate, evaluate and treat risks, then test that the controls work.
SourcePublic bodies, providers of public services, and deployers of credit-scoring and life or health insurance AI must complete a fundamental rights impact assessment before first use and report it to the regulator.
SourcePublished in May 2025, the international standard for AI system impact assessment sets how organizations should assess effects on individuals, groups and society.
SourceNIST's Generative AI Profile names 12 risk categories unique to or amplified by generative AI, from confabulation to information security and harmful bias.
SourceEight risk engagements, delivered on their own or combined with our other assessment services, AxiReady and AxiSentinel.
EU AI Act tier determination (prohibited, high-risk, limited, minimal), Annex III and general-purpose AI checks, and U.S. state and sector mapping for every system, with AxiReady finding the systems you did not know you had.
A full risk assessment across your AI portfolio using the NIST AI RMF Map and Measure functions and the ISO/IEC 23894 process, prioritized by business impact.
The EU AI Act Article 27 assessment for public bodies, public service providers, lenders and insurers, ready to submit and combinable with your GDPR data protection impact assessment.
Impact assessments following ISO/IEC 42005:2025, documenting effects on people, groups and society across the system's lifecycle.
Assessment against the 12 NIST AI 600-1 risk categories for chatbots, copilots and LLM applications, including data leakage, confabulation and content risks.
Autonomy, tool access, permissions, escalation paths and oversight-gap scoring for AI agents that act on your behalf.
Risk review of AI you buy, with a Procurement Readiness Review and evidence for third-party registers such as DORA Article 28.
Your risk register kept live: drift, anomalies, new regulations and control failures surface as they happen, Always On or On Demand.
Accuracy, robustness, drift and reliability under real operating conditions.
Discrimination, unequal error rates and effects on protected groups.
Personal data use, data minimization, leakage and cross-border transfer.
Poisoning, evasion, prompt injection, model theft and misuse.
Robotics, autonomous vehicles, medical and infrastructure systems that can hurt people.
Obligations across 220+ frameworks and 940+ obligations in 66+ jurisdictions in 43 countries, and the fines attached. We also track 201 AI audit mandates across 81 countries and 8 regions.
Vendor dependence, concentration, change control and business continuity.
Trust, transparency, misinformation and wider societal effects.
Built on the ISO 31000 and ISO/IEC 23894 risk process, with a signed result at the end.
Map every AI system, its purpose, users and affected people, using AxiReady discovery where needed.
Enumerate risks against the obligations that apply, drawn from 220+ encoded frameworks and 940+ obligations.
Score likelihood and severity for each stakeholder group, with a clear rationale for every rating.
Test whether existing controls work, then set treatments, owners and deadlines for what remains.
A qualified AxiLayer AI auditor signs the assessment; leadership receives a board-ready summary.
AxiSentinel keeps the risk picture current as systems, data and regulations change.
Credit-scoring AI is high-risk under the EU AI Act and triggers a fundamental rights impact assessment.
Life and health insurance pricing and risk assessment AI is high-risk and needs an Article 27 assessment.
Public bodies deploying high-risk AI must assess fundamental rights impact before first use.
Clinical and administrative AI where safety, bias and data protection risks meet.
Hiring and workforce AI, high-risk in the EU and regulated across U.S. states and cities.
AI in energy, water, transport and telecom, where failures carry physical consequences.
Our fees never depend on the result, so every risk rating reflects the evidence alone.
AxiSentinel keeps your risk register current between assessments instead of letting it age on a shelf.
220+ frameworks and 940+ obligations across 66+ jurisdictions in 43 countries, so one engagement covers the EU, U.S., Gulf and Asia-Pacific rules that apply. We also track 201 AI audit mandates across 81 countries and 8 regions.
A qualified AxiLayer AI auditor signs every assessment, re-verifiable by regulators, buyers and boards.
Sources: European Commission AI Act Service Desk, Article 27; EU AI Act Article 9; ISO/IEC 42005:2025 (May 2025); NIST AI 600-1 Generative AI Profile; MIT AI Risk Repository, December 2025 update.
Risk classification is the first decision in every assessment, and each market draws the lines differently. We classify every system under each regime that applies.
Every assessment ends with a scored, signed picture of where your AI risk sits. An illustrative example:
The dates that shape AI risk programs from 2025 to 2028.
AI agents that plan and act need bounded permissions and tested escalation paths.
Model-level risk now carries public frameworks and incident reporting duties.
Attacks on models and data are now regulated cyber risks.
Who pays when AI fails is being rewritten.
The heat map is an illustrative example, not client data. Status and dates reflect public sources reviewed in October 2026; confirm against official texts before relying on them.
Compliance readiness work requires clear scope, recognized authority, and appropriate accreditation or notification where a law or standard requires it. AxiLayer AI provides evidence-based readiness assessments, review reports and signed findings that help organizations prepare for regulatory submission, enterprise procurement, and public accountability.
AxiLayer AI does not represent its work as accredited certification, notified-body approval, CE marking authorization, or a regulatory guarantee.
AI rules are moving from guidance to dated obligations on every continent. Four developments set the pace.
The 2026 AI Omnibus set firm dates: Article 50 transparency from 2 August 2026, Annex III high-risk obligations from 2 December 2027, and AI in regulated products from 2 August 2028. The readiness window is open now.
SourceThe new standard for bodies that audit and certify ISO/IEC 42001 sets defined auditor competence in data science, AI ethics and system validation. Certification audits are now deeper, so preparation matters more.
SourceSince 22 January 2026, developers and deployers of high-impact and generative AI in Korea need risk assessment and transparency measures, and foreign firms without a Korean office must name a local representative.
SourceColorado's replacement AI law takes effect 1 January 2027, with documentation, consumer notice, adverse decision explanations, human review and three years of compliance records across seven consequential domains.
SourceEight readiness engagements, delivered on their own or combined with AxiReady discovery and AxiSentinel continuous evidence.
Risk classification, Annex IV technical documentation review and Article 43 pathway mapping, timed to the 2 December 2027 and 2 August 2028 deadlines, plus Article 50 transparency checks.
Gap assessment, internal audit, Statement of Applicability review and Stage 1 and Stage 2 preparation, built to the auditor expectations in ISO/IEC 42006.
Documented verification of Govern, Map, Measure and Manage, including the Generative AI Profile, with a signed attestation of what is in place today.
Review of AI risk identification, analysis, treatment and monitoring processes against ISO/IEC 23894 and ISO 31000 principles.
A signed Compliance Passport, backed by a re-verifiable evidence chain, naming scope, frameworks, result and date.
Evidence packs that answer enterprise AI questionnaires, government AI procurement requirements and RFP compliance sections, so sales cycles do not stall on governance.
Healthcare, financial services, insurance, government, defense and critical infrastructure, mapped to sector rules such as HIPAA, SR 26-2 (which replaced SR 11-7 in April 2026), Canada's OSFI E-23 and CMMC 2.0.
Evidence refreshed every day by AxiSentinel, so readiness status stays current between reviews and is visible in the Live Compliance Passport status.
Key AI compliance dates our readiness programs are built around.
AI-generated content labeling measures
TRAIGA (HB 149), Illinois AI in employment law, California CPPA regulations
AI Basic Act
AI Basic Act
Data (Use and Access) Act, automated decision-making provisions
IT Rules amendment on synthetic content
Law on Artificial Intelligence
AI Act Article 50 transparency obligations
Privacy Act automated decision transparency (APP 1.7 to 1.9)
SB 26-189 and California ADMT duties
Full compliance deadline
OSFI Guideline E-23 on model risk
AI Act Annex III high-risk obligations
AI Act high-risk rules for AI in regulated products
One readiness program, mapped across 220+ encoded frameworks and 940+ obligations in 66+ government jurisdictions in 43 countries on six continents. We also track 201 AI audit mandates across 81 countries and 8 regions.
AI Act readiness for providers and deployers, Annex IV documentation, GDPR, DORA and NIS2 alignment, Italy's Law 132/2025.
Data (Use and Access) Act automated decision rules, ICO AI guidance, PRA SS1/23 model risk, FCA consumer duty.
Colorado SB 26-189, Texas TRAIGA, California ADMT, NYC Local Law 144, NIST AI RMF, OMB AI policy, Canada's OSFI E-23.
DIFC Regulation 10, Saudi SDAIA AI ethics and risk framework, UAE and Qatar data protection laws, Dubai AI Seal readiness.
Korea and Taiwan AI Basic Acts, Japan's AI Promotion Act, China's labeling measures, Vietnam's AI law, Singapore AI Verify, India and Australia.
National data protection laws and emerging AI rules across South Africa, Nigeria, Kenya, Brazil, Chile and beyond.
Framework by framework status, scored and dated.
Every gap with owner, priority and remediation guidance.
Organized technical documentation and records, ready for review.
Signed by a qualified AxiLayer AI auditor, with scope, frameworks, result and date.
A clear view of readiness, risk and next steps for leadership.
The schedule and evidence needed to keep readiness current.
Organized evidence for regulators, supervisors and notified body review.
Proof of AI governance that buyers and contracting officers can verify.
Evidence for boards, auditors, insurers and investors.
A prepared path into ISO/IEC 42001 certification with an accredited certifier.
Sources: Gibson Dunn on the EU AI Act Omnibus agreement; Chartered Quality Institute on ISO/IEC 42006 (July 2025); CASRAI guide to Korea's AI Basic Act; Greenberg Traurig on Colorado SB 26-189; Airia global AI effective-date timeline. Dates as published at the time of writing; confirm against official texts before relying on them.
Where AxiLayer AI fits on the path to certification, and where an accredited certifier or notified body takes over.
Gap assessment, evidence and remediation against ISO/IEC 42001, the EU AI Act and local law.
Signed by a qualified AxiLayer AI auditor, naming scope, frameworks, result and date.
Certifiers are accredited against ISO/IEC 17021-1 and ISO/IEC 42006. UKAS granted the first 42001 accreditation on 15 Jan 2026; ANAB followed on 10 Mar 2026. Source
Most Annex III systems use internal control (Annex VI); some biometric systems need a notified body (Annex VII). Annex III duties apply from 2 Dec 2027. Source
AxiLayer AI prepares clients for steps 3 and 4. It is not a notified body and does not issue accredited certification.
Harmonized standards give a presumption of conformity only once cited in the Official Journal. EN 18286 was cited on 14 October 2026. The others are not cited yet, so readiness work maps to the drafts.
The main certification and assurance schemes, and what each one actually covers.
AI management system Source
High-risk AI requirements Source
AI testing toolkit; Singapore leads ISO/IEC 42119-8 on GenAI testing Source
High-risk AI before deployment Source
GenAI security basic requirements; content labeling Source
Layered model: 42001, machine and personnel evaluation Source
Profession, code of ethics, skills framework Source
Status and dates reflect public sources reviewed in October 2026; confirm against official texts before relying on them.
Navigating the global AI regulatory landscape requires deep expertise in multiple jurisdictions, frameworks, and sector-specific requirements. AxiLayer AI's regulatory consulting services provide organizations with the strategic guidance they need to build compliance programs that are both technically sound and operationally sustainable.
AI governance has become a global, dated obligation. Four developments shape what organizations must have in place.
Regulation (EU) 2026/1744 confirmed the new high-risk dates of 2 December 2027 and 2 August 2028 and requires providers and deployers to take measures that support AI literacy among their staff.
SourceFederal agencies need Chief AI Officers, AI governance boards, impact assessments and human oversight for high-impact AI, and AI contracts that cover data use, monitoring and portability.
SourceThe first binding international AI treaty, covering human rights, democracy and the rule of law, moved closer to entry into force when the European Union ratified it on 15 May 2026.
SourceIn May 2026 the OECD launched version 2.0 of the Hiroshima AI Process reporting framework, streamlined so small and medium-sized organizations can report on their AI governance too.
SourceEight advisory services, delivered on their own or combined with AxiReady discovery and AxiSentinel continuous evidence.
Governance charter, operating model, roles, RACI and accountability, built on ISO/IEC 42001 and ISO/IEC 38507 so the program is ready for audit from day one.
A regulatory applicability map for every market you operate in, drawn from 220+ encoded frameworks and 940+ obligations, with a prioritized, dated roadmap.
AI use, generative AI, acceptable use, ethics, data, procurement and incident response policies, written for your organization and your regulators.
AxiReady discovers the AI in use across the organization, including shadow AI, and classifies each system by risk under each applicable law.
Board briefings, AI risk appetite statements, quarterly regulatory horizon reports and decision support for directors and executive teams.
Support for Chief AI Officers, governance boards, use case inventories and impact assessments for federal, state, local and international government bodies.
Vendor assessment frameworks, due diligence questionnaires and contract clauses for data use, monitoring, audit rights and exit, aligned to OMB M-25-22 and DORA.
Role-based training for boards, legal, compliance, technical and operational teams, built to meet the EU AI Act literacy duty and similar rules worldwide.
One advisory team, mapped across 220+ encoded frameworks and 940+ obligations in 66+ government jurisdictions in 43 countries on six continents. We also track 201 AI audit mandates across 81 countries and 8 regions.
AI Act roles and obligations, Omnibus timeline, AI literacy, GDPR impact assessments, DORA third-party risk, Council of Europe AI Convention.
Regulator-led AI principles, ICO AI and data protection guidance, PRA SS1/23 model risk, FCA consumer duty, Data (Use and Access) Act.
OMB M-25-21 and M-25-22, NIST AI RMF, Colorado, Texas and California AI laws, NYC Local Law 144, Canada's OSFI E-23.
DIFC Regulation 10, Saudi SDAIA AI ethics and risk framework, UAE national AI strategy and data laws, Qatar data protection law.
Korea and Taiwan AI Basic Acts, Japan's AI Promotion Act and government AI guideline, China's AI rules, Vietnam's AI law, Singapore's Model AI Governance Frameworks including agentic AI, India's AI Governance Guidelines, Australia's Guidance for AI Adoption.
African Union Continental AI Strategy, Kenya and Nigeria national AI strategies, Rwanda's civil service AI training, data protection laws across Africa, Brazil's and Chile's AI bills, Peru's AI regulation and Colombia's national AI policy.
A focused engagement on one question: which laws apply, where the gaps are, and what to do first.
End-to-end design of your AI governance program, policies, inventory and roadmap.
Ongoing senior support for your Chief AI Officer, governance board and compliance team.
Regular briefings and horizon reports so directors stay ahead of AI regulation.
AxiReady inventories the AI estate and the data, vendors and decisions it touches.
Each system is mapped to the laws, standards and sector rules that apply in each market.
Governance structure, policies, controls and roles, sized to your organization.
Controls embedded in workflows, teams trained and evidence collection switched on. Work we implement is signed only by an auditor who did not do that work.
AxiSentinel monitors continuously and regulatory updates keep the program current.
Which laws and standards apply, where, and from when.
Clear roles, decision rights and escalation paths.
Approved, ready to publish policies and procedures.
Prioritized actions with owners and dates.
A concise view of AI risk, obligations and progress.
Role-based content and records of completion.
Sources: White & Case on the EU AI Omnibus entering into force; Hunton on OMB M-25-21 and M-25-22 (April 2025); Fix the AI Gap on the EU ratification of the Council of Europe AI Convention (May 2026); OECD on the Hiroshima AI Process reporting framework 2.0 (May 2026).
A growing number of rules require a named person to own AI. We help define the role, its authority and its reporting line.
Named within 60 days under OMB M-25-21, with AI governance boards at CFO Act agencies within 90 days. Source
Foreign AI businesses above set revenue or user thresholds must appoint one under the AI Basic Act. Source
Required under Regulation 10 for high-risk processing once certification requirements are set. Source
Required by the Policy for the responsible use of AI in government, version 2.0, from 15 Dec 2025. Source
Required by the government guideline on generative AI procurement and use, version 2.0 (12 Jun 2026). Source
Proposed for every public body in the draft Organic Law approved by the Council of Ministers on 26 May 2026. Source
The guidance documents our advice is built on, in the order they arrived.
Also see: SEC, Jan 2025 ISO/IEC 38507
Status and dates reflect public sources reviewed in October 2026; confirm against official texts before relying on them.
AI compliance is not a one-time event, it is an ongoing obligation. AI systems change through retraining and updates, regulatory requirements evolve, and new risks emerge from deployment in real-world environments. AxiLayer AI's continuous monitoring services provide organizations with the oversight infrastructure to keep evidence current and respond proactively to compliance changes, delivered on AxiSentinel™, our own platform, which runs on the cadence you configure and is always paired with qualified human review.
AxiLayer AI does not resell someone else's monitoring stack. This service is delivered on AxiSentinel™, our own compliance platform, configured to evaluate client AI systems on whatever cadence you choose, Always On for continuous coverage or scheduled and On Demand, against the frameworks that actually apply to them, and surface what a qualified AxiLayer AI auditor needs to see, the moment it matters. It runs across any major cloud provider, on-premises, or in-region to meet data residency and localization rules worldwide, including the EU's GDPR, China's PIPL, and similar regulations across the Gulf, APAC, Latin America, and beyond. Every cloud, no interference, fully protected, configured to each client's needs: see every deployment option.
Most compliance tooling shows you a snapshot. Run it continuously, and the gap between something changed in your AI system and someone qualified knows about it shrinks from a quarterly review cycle to real time; run it on a schedule that fits your organization, and the same signed evidence is there whenever you check.
AxiSentinel agents evaluate your AI systems against the applicable regulatory framework on the cadence you configure, from continuous to On Demand. A threshold breach generates a Provisional Alert, not a finding, a flag for human review.
A qualified AxiLayer AI auditor reviews the underlying evidence, validates or overrides the alert, and applies a cryptographic signature. This is the step where a flag becomes a signed finding.
Once signed, the finding is committed to AxiLayer's cryptographic evidence chain and a Compliance Passport is issued, tamper-evident, traceable, and structured for regulatory review.
Run it Always On or on your own schedule. Every inference event you monitor is evaluated in full, no sampling, no gaps, and no waiting for the next review window to discover a system drifted out of conformity months ago.
Provisional Alerts are machine-generated; findings and Compliance Passports are signed by a qualified AxiLayer AI auditor. Oversight is architectural, not a policy promise.
Each alert carries the specific regulatory citation it was evaluated against, the system it came from, and a full evidence trail, linked into a signed, tamper-evident evidence chain.
Our RegDef architecture encodes regulatory obligations as machine-executable detection logic. When a regulation changes, the RegDef package updates, deployed agents do not have to be rebuilt.
AxiSentinel continuously measures how much genuine human oversight your AI decisions actually receive, quantified as a composite score, the evidence regulators increasingly ask for.
In any major cloud, in your data center or fully air-gapped, with gates, holds, containment and stop built in.
AxiSentinel is live and deployable across cloud, on-premises and air-gapped environments; monitoring engagements are scoped and staffed by AxiLayer's assessment team.
Each signal is tied to the rule that makes it matter. A breach raises a Provisional Alert for a qualified AxiLayer AI auditor, never an automatic finding.
Monitoring and reporting duties that apply once an AI system is in use, and the clock each one runs on.
The signal view is illustrative, not client data. Status and dates reflect public sources reviewed in October 2026; confirm against official texts before relying on them.
Validation confirms that an AI system meets its intended use requirements; verification confirms it was built correctly against its specifications. AxiLayer AI provides V&V services that give organizations and their stakeholders confidence that AI systems perform as claimed across their intended deployment environments.
Regulators, standards bodies and buyers have moved from asking whether AI works to asking for proof. Four developments define the bar every AI system is now measured against.
High-risk AI must declare its accuracy levels and metrics, stay resilient to errors and feedback loops, and resist data poisoning, model poisoning and adversarial examples, throughout its lifecycle.
SourceNIST's March 2025 taxonomy of adversarial machine learning attacks and mitigations sets the vocabulary security and assurance teams now test against.
SourceFDA's final guidance (December 2024) lets AI-enabled devices change after clearance only under a predetermined, validated change control plan.
SourcePrompt injection, sensitive information disclosure, excessive agency and the other 2025 risks define how generative and agentic AI must be tested.
SourceEight V&V engagements, delivered on their own or combined with our other assessment services, AxiReady and AxiSentinel.
Full V&V of a new AI system against its intended use, acceptance criteria and every applicable framework before it goes live.
Validation separate from the developer for credit, fraud, pricing and risk models, built for model risk management and supervisory review.
Prompt injection, jailbreak, data leakage, hallucination and output safety testing for chatbots, copilots and LLM applications.
Tool permissions, excessive agency, multi-step reliability and human escalation testing for autonomous AI agents.
Targeted re-validation after model updates, retraining or vendor version changes, including FDA change control plans.
Formal acceptance testing for agencies and enterprises buying AI, so the system is proven before contract sign-off.
Agreed checks re-run automatically as data drifts and models change, Always On or On Demand, with every result signed.
Discovery of every AI system in use, including tools adopted without approval, so validation covers what is actually running.
Eight dimensions, scoped to your system's risk and intended use.
Metrics matched to intended use, tested on held-out and real-world data, with declared accuracy levels verified against what the system actually delivers.
Distribution shift, noisy and incomplete inputs, edge cases and operational limits, aligned with ISO/IEC 24029 robustness methods.
Outcome and error-rate disparities across protected groups and proxies, aligned with ISO/IEC TR 24027 and bias-audit rules such as NYC Local Law 144.
Evasion, poisoning, extraction and privacy attacks mapped to NIST AI 100-2 E2025 and MITRE ATLAS, with red-team evidence.
Hallucination and grounding, prompt injection and jailbreak resistance, sensitive data leakage and output safety, mapped to the OWASP LLM Top 10.
Tool use, permissions and excessive agency, multi-step task reliability, escalation paths and human oversight gaps in autonomous agents.
Training, validation and test data relevance, representativeness and provenance, as EU AI Act Article 10 requires for high-risk systems.
Whether people can understand, monitor, override and stop the system in practice, as EU AI Act Article 14 requires.
Every test is traceable to the obligation it evidences, drawn from 220+ frameworks encoded and 940+ obligations across 66+ jurisdictions in 43 countries. We also track 201 AI audit mandates across 81 countries and 8 regions.
We agree what the system is for, who it affects, and the measurable criteria that define success, before any test runs.
Rigor scales with consequence, in the spirit of IEEE 1012 integrity levels: higher-risk systems get deeper, broader testing.
Separate test data, adversarial red-teaming and boundary testing run by AxiLayer AI, not by the team that built the system.
We verify behavior in the full operating context, including interfaces, human review steps and fallback procedures.
Findings are reviewed and signed by a qualified AxiLayer AI auditor and delivered as a re-verifiable Compliance Passport.
AxiSentinel re-runs the agreed checks after every model change and as data drifts, Always On or On Demand, so validation never goes stale.
Model validation separate from the developer, in line with SR 26-2, the April 2026 guidance that replaced SR 11-7, for credit, fraud and AML models.
Clinical AI performance, subgroup accuracy and change control evidence for FDA and EU MDR pathways.
TEVV evidence for autonomy and decision support, including air-gapped test environments.
Formal acceptance testing before an agency authorizes an AI tool for deployment.
Pricing and underwriting model validation against fairness and unfair discrimination rules.
Bias audits and performance validation for hiring and workforce decision tools.
The team testing your system did not build it, and a qualified AxiLayer AI auditor who did not build it signs the result.
AxiSentinel turns a one-time validation into a living record, re-checked after every change.
In your environment, in your Azure region, or fully air-gapped.
A qualified AxiLayer AI auditor signs every finding; anyone can re-verify the result.
Sources: European Commission AI Act Service Desk, Article 15; NIST, AI 100-2 E2025 (March 2025); FDA final PCCP guidance for AI-enabled device software functions (December 2024); OWASP Top 10 for LLM Applications (2025); ISO/IEC and IEEE standards as named.
Select a sector to see the rules that set its validation bar, and what we test against them.
Lifecycle performance validation and post-market monitoring in marketing submissions. Source
Representative data, lifecycle approach, monitoring of deployed models, clear user information. Source
Internationalizes the ten good machine learning practice principles. Source
One combined MDR or IVDR and AI Act assessment, with accuracy, robustness and cybersecurity metrics; high-risk device duties from 2 Aug 2028. Source
Post-release auditing and impact assessment by third parties for models deployed at scale. Source
Replaces SR 11-7: conceptual soundness, outcomes analysis and ongoing monitoring, scaled to risk. Source
Machine learning models must be explainable and their performance must justify their complexity. Source
Lifecycle validation and monitoring of AI and machine learning models. Source
Materiality assessment and lifecycle testing and validation controls. Source
27 use cases from 20 banks, including AI checks on AI outputs. Source
Governance, third-party risk and record-keeping for AI in capital markets. Source
Written AI program, lifecycle risk controls, internal audit and vendor oversight. Source
Governance for life, private auto and health insurers; quantitative testing rule still to come. Source
Data governance, fairness, explainability, oversight and cybersecurity for insurance AI. Source
Safety assurance for AI elements in road vehicle systems. Source
Audited safety management system, safety case, simulation, track and real-world testing, in-service monitoring. Source
Safety components with self-evolving machine learning need third-party conformity assessment. Source
Learning assurance, explainability and human and AI teaming for Level 1 and 2 AI. Source
First proposed aviation rules for AI, aligned with AI Act high-risk requirements. Source
Separates learned from learning AI and assures each project step by step. Source
Rigorous hardware and software V&V and realistic operational test and evaluation for autonomy. Source
Principles of Responsible Use, including generative AI and adversarial threats. Source
Pre-deployment testing for high-impact AI and testable contract terms for AI purchases. Source
Stronger testing and monitoring duties for federal automated decisions. Source
Prompt injection, system prompt leakage, vector and embedding weaknesses and more. Source
Security risks specific to autonomous AI agents. Source
Risk bounding, human accountability and baseline testing for agents. Source
Real-world GenAI testing by 16 testers and 17 deployers, with a Testing Starter Kit. Source
Frontier AI frameworks that address third-party evaluation and incident reporting. Source
The standards and guidance our test plans draw on, by year of publication.
Status and dates reflect public sources reviewed in October 2026; confirm against official texts before relying on them.
Comprehensive, well-organized documentation is the foundation of any defensible AI compliance program. AxiLayer AI's documentation services produce the technical, legal, and executive-level documents that organizations need to demonstrate compliance to regulators, procurement teams, board members, and the public.
Regulators now publish templates, deadlines and retention periods for AI documentation. Four developments set the pace.
The European Commission published the mandatory template on 24 July 2025. General-purpose AI providers must publish a summary of training content, with models already on the market due by 2 August 2027.
SourceSMEs and the new small mid-cap category, under 750 employees, get simplified technical documentation templates that notified bodies must accept. Simpler, but still required.
SourceSince 1 January 2026, developers of generative AI systems released or updated since 2022 must publish a high-level summary of their training data, its sources, volume and treatment.
SourceThe new international standard on AI system impact assessment sets out when to assess, how to document it, and how records feed the ISO/IEC 42001 management system.
SourceEight documentation services, delivered on their own or alongside our audits, assessments and AxiSentinel continuous evidence.
Annex IV technical files built to Article 11, using the simplified templates where SMEs and small mid-caps qualify, with a retention plan to match Article 18.
Article 53 model documentation and public training content summaries on the Commission template, plus California AB 2013 disclosures.
Impact assessments to ISO/IEC 42005, EU AI Act fundamental rights impact assessments, GDPR DPIAs and Canada's Algorithmic Impact Assessment.
One control, mapped once, shown against every framework that needs it, drawn from 220+ encoded frameworks and 940+ obligations.
Clear, standard documentation of purpose, data, performance, limitations and intended use for every model and dataset.
Signed, re-verifiable evidence and logging records, organized for auditors, regulators and litigation holds, with retention schedules by jurisdiction.
Executive summaries, regulatory submissions, public sector AI use case inventories and Hiroshima AI Process reports.
Article 72 monitoring plans and reports, and serious incident reporting packs, kept current by AxiSentinel.
Retention rules differ by market. We build every documentation set to the longest period that applies to you.
EU AI Act Article 18: technical documentation, quality system and conformity records for high-risk AI
SourceEU AI Act Article 19: minimum retention for automatically generated high-risk AI logs
SourceOne documentation set, mapped across 220+ encoded frameworks and 940+ obligations in 66+ government jurisdictions in 43 countries on six continents. We also track 201 AI audit mandates across 81 countries and 8 regions.
Annex IV technical files, Article 53 GPAI documentation, fundamental rights impact assessments, Articles 72 and 73 monitoring and incidents, GDPR records.
UK GDPR DPIAs and accountability records, the Algorithmic Transparency Recording Standard for public bodies, PRA SS1/23 model inventories.
California AB 2013 and SB 53, FEHA records, Colorado SB 26-189, NYC LL 144 summaries, OMB use case inventories, Canada's Directive on Automated Decision-Making.
DIFC Regulation 10 records, Saudi SDAIA framework documentation, UAE and Qatar data protection records.
China's algorithm filing and AI content labeling records, Korea's five-year records for high-impact AI, Vietnam's technical files and logs, Singapore AI Verify reports, Japan, India's synthetic content metadata and DPDP Rules, Australia's government AI transparency statements.
Impact assessments under South Africa's POPIA, Kenya's Data Protection Act and Brazil's LGPD, Peru's three-year AI records, Chile's draft technical documentation duties, plus emerging AI rules across both regions.
Identify each system, its role, and the documents every applicable law requires.
AxiReady and AxiSentinel pull facts from the live system, not from memory.
Documents written to the official templates and standards for each market.
Checked and signed by a qualified AxiLayer AI auditor who did not draft the documents.
Version-controlled and refreshed as systems, data and rules change.
Sources: WilmerHale on the EU training content summary template (July 2025); Orrick on the AI Omnibus (May 2026); Crowell on California AB 2013; CASRAI on ISO/IEC 42005 (May 2025); EU AI Act Articles 18 and 19; McDermott Will & Schulte on California's FEHA automated decision rules; Greenberg Traurig on Colorado SB 26-189.
Documentation no longer stays in a drawer. These are the registers and filings where your AI documentation may end up in public.
Providers register under Articles 49 and 71; public-authority deployers must register and may not use an unregistered system. Most entries are public. Source
A security self-assessment report, service agreement, data annotation rules, a keyword list of 10,000 or more and a test question set. 988 generative AI services were filed by 30 Jun 2026. Source
Published every year; the 2025 inventory listed 3,611 use cases from 56 agencies, 445 of them high-impact. Source
Mandatory records for central government departments and arm's-length bodies serving the public. Source
Assessments published on the Open Government Portal; a federal AI Register launched in November 2025. Source
1,579 published algorithm descriptions from 531 public organizations as of October 2026. Source
Agencies keep use-case registers and publish transparency statements, updated every year. Source
SB 53 transparency reports and frontier AI frameworks; AB 2013 training data summaries, both from 1 Jan 2026. Source
Safety and reliability documentation kept for five years under the AI Basic Act Enforcement Decree. Source
Providers keep documentation and logs and must justify their risk classification. Source
Labels plus embedded provenance metadata on synthetic content, from 20 Feb 2026. Source
A public inventory of state agency AI systems under the LOADinG Act. Source
When something goes wrong, documentation has to be ready within these windows. Bars use a log scale.
Article 73 deadlines are set in the AI Act; the Commission guidance and template remain in draft. Status and dates reflect public sources reviewed in October 2026; confirm against official texts before relying on them.
Governments are now the largest single class of high-risk AI deployer on earth, benefits determination, taxation, immigration, policing, licensing, courts, health and citizen service are all being automated at once. AxiLayer AI and the AxiSentinel™ platform give public bodies in the UAE and wider GCC, the European Union, Asia-Pacific, North America and beyond the one thing an annual audit cannot: Always On evidence that each system is still compliant today, in the jurisdiction it actually operates in. Since 19 October 2026, the GSA AI clause GSAR 552.239-7001 has applied to federal LLM acquisitions.
Public-sector AI is unlike commercial AI in three ways that break the traditional assurance model. First, the decisions are non-optional, a citizen cannot shop elsewhere for a benefits determination, a visa outcome or a tax assessment. Second, the accountability chain runs to parliaments, auditors-general, ombudsmen and courts, all of whom require durable evidence rather than a consultant's opinion. Third, government AI is now being retrained, fine-tuned and re-prompted continuously, which means the system that passed a point-in-time review in January is materially not the system running in July.
A conventional audit produces a snapshot with a shelf-life measured in weeks. Regulators in every major market have moved decisively toward continuous obligations instead: post-market monitoring and logging under the EU AI Act, ongoing performance monitoring and periodic reassessment under Saudi Arabia's national AI Risk Management Framework, continuous monitoring and review under the CBUAE's AI guidance for licensed financial institutions, and lifecycle risk management under Korea's AI Framework Act. The obligation is continuous. The assurance has to be continuous too.
Registered in SAM.gov for all award types, CAGE 20JV1, UEI CB76ENDLMUC9. Full capability profile, NAICS and PSC codes, and the one-page capability statement for contracting officers.
Government ProfileAxiLayer AI is built to work with national, federal, emirate, state, provincial and municipal bodies, plus the system integrators and prime contractors that deliver AI into them.
Contact UsThere is no horizontal AI statute in the UAE or the wider GCC equivalent to the EU AI Act. That does not mean there is no obligation, it means the obligation binds through different instruments. In the UAE it arrives through federal data protection law, emirate-level authorities, free-zone rulebooks and sector licensing. In Saudi Arabia it binds through SDAIA policy and public-sector procurement. In Qatar it binds through central bank licensing. For a public body or a vendor selling into one, the practical consequence is that compliance is multi-regulator by default, and the evidence a regulator asks for differs by emirate and by free zone.
The UAE is the most institutionally advanced AI state in the region and has deliberately chosen a layered, pro-innovation model over a single statute.
Abu Dhabi has built a dedicated institutional owner for AI, which makes it the most audit-ready emirate for public-sector AI.
Dubai runs the most commercially active AI-governance apparatus in the region, and increasingly ties market access to a verification mark.
The single most consequential AI-specific rulebook in the Middle East, and the one most often missed because it applies only inside the free zone.
Saudi Arabia has moved furthest in the region from principles to operational machinery, and it centralises through a single authority, which makes it the most tractable GCC market to certify against.
Smaller GCC states run leaner governance models, but each has at least one instrument that genuinely binds, and knowing which one is the whole game.
The AI Omnibus entered into force on 27 July 2026 (published in the Official Journal on 24 July 2026) after a compressed passage: proposed 19 November 2025, provisional political agreement 7 May 2026, European Parliament approval 16 June 2026 by 423 votes to 57, Council sign-off 29 June 2026. It deferred the high-risk conformity deadlines, and left the transparency and AI-literacy duties exactly where they were. Any public body that paused its program on the assumption that 2 August 2026 was a single cliff edge has the timeline wrong in both directions.
Prohibited-practice breaches reach the higher of €35 million or 7% of worldwide annual turnover; most other provider and deployer breaches reach €15 million or 3%. Public bodies are not exempt from the enforcement architecture, and Member States set their own regime for public authorities.
Penalty CalculatorSpain's AESIA is the first dedicated national AI supervisory agency in the EU. Italy legislated its own national AI law in 2025 alongside the Act. Germany routes market surveillance through the Bundesnetzagentur. France's CNIL has issued its own AI recommendations. The Netherlands runs algorithm oversight through the Autoriteit Persoonsgegevens and expects an impact assessment for human rights and algorithms. The Act is uniform; the supervisor, the evidence format and the enforcement appetite are not.
Asia-Pacific is not one market. Korea and China now run binding, enforceable AI regimes. Japan, Australia and India have chosen promotion-oriented or principle-based frameworks, though India has layered binding deepfake-labeling rules on top. Singapore has the most mature toolkit in the world for testing AI systems without a statute at all. For a government or a vendor operating regionally, the practical result is that the same AI system can be subject to a mandatory impact assessment in Seoul, a mandatory content label in Shanghai, a voluntary standard in Canberra and a testing framework in Singapore, simultaneously.
The world's second comprehensive AI statute after the EU AI Act, consolidating nineteen separate bills, and the fastest-moving compliance deadline in Asia.
China regulates AI through registration and labeling rather than conformity assessment, a fundamentally different evidence model, and one with real teeth.
No AI statute, and yet the most operationally credible AI-testing ecosystem in the world, which is why Singapore is the reference implementation for evidence-based assurance.
Japan legislated deliberately light: the Act sets principles, institutions and coordination rather than compliance obligations, and the government's stated aim is to be the most AI-friendly country in the world.
India has paired a principle-based national framework with binding, technically specific deepfake rules, a combination that catches most government citizen-facing AI.
Australia reversed course, and understanding why matters: obligations did not disappear, they were pushed back into existing law, where they are harder to see and no easier to satisfy.
The second tier of APAC markets is where most regional AI programs actually get deployed, and where coverage gaps most often appear.
The federal posture shifted from safety-first to adoption-first, and then to actively contesting state regulation, but the government's own AI use remains governed.
State law is where US government AI obligations actually bite, and 2026 delivered both a major new regime and a major repeal.
The UK has no AI act, but it does have the most concrete public-sector AI transparency obligation in the Anglosphere.
Government-specific obligations often arrive before general AI law, Canada is the clearest example anywhere.
Standards are the interoperability layer. A single well-built evidence base can satisfy several regimes at once, which is the entire economic argument for continuous assurance.
These are the deployment classes that regulators in the EU, Korea, Saudi Arabia, the UAE, Canada and the United States have specifically identified as high-risk, high-impact or subject to mandatory assessment. AxiSentinel is configured per use case, not shipped as one fixed pipeline.
Agencies now use AI to draft analyses of alternatives, score proposals and prepare acquisition and benefits decisions. Federal policy treats AI that is a principal basis for decisions with significant effects as high-impact, with testing, impact assessment and human oversight expected before use.
Agencies now use AI in benefits, case handling, translation and citizen services, and every new system widens the surface adversaries probe. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
AxiSentinel is AxiLayer AI's configurable AI control and assurance platform, live and deployable across cloud, on-premises and air-gapped environments. Access is by invitation, and no Compliance Passport is issued without a qualified AxiLayer AI auditor signing it.
Regulation-encoded agents evaluate each monitored AI system against the specific framework that binds it, continuously or on the schedule you set, rather than only at an annual review point. A threshold breach generates a Provisional Alert.
A tamper-evident, time-ordered record of what the system did and what was checked, the evidence format an auditor-general, parliamentary committee, ombudsman or market surveillance authority can verify directly.
Oversight regimes require meaningful human involvement. AxiSentinel detects the drift from real review to rubber-stamping, the failure mode behind most public algorithmic scandals, and directly relevant to EU AI Act Article 14, Korea's oversight duties and CBUAE human-in-the-loop expectations.
AxiSentinel is designed to run inside the agency's own environment, sovereign cloud, on-premise, disconnected or restricted. Monitored data does not need to cross a national boundary.
Each monitored system is scoped to its jurisdiction rather than an averaged global baseline, so a system running in Abu Dhabi, Frankfurt and Seoul is measured three times against three sets of duties.
A contracting authority, vendor registry or procurement portal can check a supplier's AI system at any time, free: its Compliance Passport status is CURRENT, UNDER REVIEW or WITHDRAWN.
Observability of how autonomous agents actually behave in production against the regulations that apply to them, distinct from general-purpose AI process observability, and the fastest-growing gap in public-sector deployments.
Autonomous vehicles, robotics, drones and sensor networks in transport, policing, defense and municipal service, where Dubai's autonomous-vehicle rules and Annex I product regimes converge.
Continuously retrained government models silently change behavior. Drift detection is also the practical answer to the EU's undefined "substantial modification" threshold under grandfathering.
Adversarial input detection and model-update poisoning prevention, so compliance monitoring and active AI threat defense sit in one platform rather than two procurement lines.
Directly addresses China's GB 45438-2025 labeling standard, India's 2026 synthetic-content rules, the EU's Article 50 marking duties and the Omnibus's new NCII/CSAM prohibition.
Scoped to the agency's own environment and use cases rather than shipped as one fixed pipeline, which is what makes a single platform viable across 66+ jurisdictions in 43 countries. We also track 201 AI audit mandates across 81 countries and 8 regions.
| Jurisdiction | Instrument | What AxiLayer AI produces |
|---|---|---|
| European Union | AI Act Art. 27 & Art. 49 | Fundamental Rights Impact Assessment pack, kept current as the deployment changes; Article 49 EU-database registration dossier; Annex IV technical documentation set; Article 26 deployer evidence and six-month log retention. |
| Saudi Arabia | SDAIA National AI RMF | Four-phase risk register mapped to context/scope, identification & assessment, treatment and continuous monitoring; draft Responsible AI Policy registration and testing evidence. |
| UAE, DIFC | DP Law Regulation 10 | Autonomous and semi-autonomous processing records, human accountability evidence and ethical-use substantiation for the Commissioner of Data Protection. |
| UAE, Federal / Abu Dhabi / Dubai | AI Charter, PDPL, AIATC, Dubai AI Seal | Charter-principle conformance mapping, PDPL automated-processing evidence, AIATC-aligned risk registers, and substantiation for Dubai AI Seal claims. |
| Republic of Korea | AI Framework Act | High-impact AI impact assessment, AI and AI-content notification evidence, risk-management-system documentation and domestic-representative support pack. |
| United States, Federal | OMB M-25-21/22, NIST AI RMF | High-impact use-case inventory entries, minimum-practice evidence, NIST AI RMF profile and GenAI Profile mapping, FedRAMP and CMMC 2.0 alignment artefacts. |
| United States, States | TRAIGA, LL144, ADMT laws | NIST AI RMF safe-harbour evidence for Texas, third-party bias-audit inputs for NYC Local Law 144, and reconciled multi-state obligation matrices. |
| Canada | Directive on ADM | Algorithmic Impact Assessment at the assessed impact level, with the ongoing monitoring and peer-review evidence the Directive requires. |
| United Kingdom | ATRS | Algorithmic Transparency Recording Standard records for central government departments, plus Public Sector Equality Duty bias evidence. |
| China | GB 45438-2025, CAC filings | Synthetic-content label verification (explicit and implicit), and monitoring for divergence between live behavior and the filed algorithm description. |
| India | IT Amendment Rules 2026, DPDP | Synthetic-content labeling and metadata verification against the 10% visibility threshold, traceability records, and seven-sutra governance mapping. |
| Australia & NZ | DTA policy, Algorithm Charter | AI transparency statement evidence, accountable-official reporting packs and Algorithm Charter records. |
| Cross-border | ISO/IEC 42001, 42005, 23894 | AI management system readiness assessment, AI system impact assessments and AI risk management documentation reusable across multiple regimes. |
Above, national and supranational AI law. Below it, a county, a city, a special district or a utility still needs its own AI use and governance policy: who approves a new tool, what obligations apply by risk tier, and what a vendor has to show before a purchase order is signed. AxiLayer AI writes that policy, encodes it as machine-checkable obligations mapped to NIST AI RMF and ISO/IEC 42001, and reviews the tools a department wants to buy against it.
A jurisdiction briefing maps your agency's or your vendor's AI estate against every framework that applies in the markets you operate in, classification, evidence format, supervisor, deadline and gap, and shows what continuous monitoring would look like in your own environment.
Credit scoring, insurance pricing, fraud detection, market surveillance, robo-advice, claims automation and KYC are now the most heavily regulated AI use cases on earth, and the regulators supervising them changed their expectations materially in 2026. AxiLayer AI and AxiSentinel™ give financial institutions and fintechs in the UAE and GCC, the European Union, Asia-Pacific, the UK and North America continuous evidence that every model in the estate is still within its approved envelope. In October 2026 alone, MAS, the HKMA and the FSB all finalized AI guidance within eight days.
2026 was not an incremental year for AI supervision in finance. Four things happened in quick succession, and together they moved the burden of proof from documentation to demonstrable, ongoing control.
US model risk guidance now formally excludes generative and agentic AI while stating that existing risk management principles, materiality, ongoing monitoring, effective challenge, still apply. Institutions must therefore govern their fastest-growing, least-understood AI class with no prescriptive standard to point at. Continuous evidence is a defensible answer to a supervisory question that has no rulebook.
Retail, commercial and investment banks, and the prudential and credit rules that govern them, are covered on the dedicated banking page.
Go to BankingA single credit-decisioning or fraud model deployed across a multinational group can be simultaneously an Annex III high-risk system in the EU, a material model under SR 26-2 in the US, an AI system requiring board accountability under CBUAE guidance in the UAE, and subject to a Risk Materiality Assessment under proposed MAS guidelines in Singapore. Each regime wants different evidence in a different format. This is the coverage map.
The Gulf now has the densest set of AI-specific financial-sector expectations outside the EU, spread across a federal regulator, two financial free zones and a virtual-asset authority.
The EBA's own conclusion is the one to internalise: the AI Act does not stand alongside existing financial regulation, it sits on top of and between it, as an additional layer over frameworks already in place.
Singapore and Hong Kong lead the world in turning AI governance principles into testable controls, which makes them the best proxy for where every other regulator is heading.
The rest of Asia-Pacific is where the largest volume of new AI deployment is happening, and where obligations are arriving fastest.
US supervision of AI in finance is now split: model risk has a new, lighter, materiality-driven framework, while conduct and fair-lending enforcement remain squarely in place.
The UK and Switzerland regulate AI in finance through model risk and governance rules rather than AI statutes, and the global standard setters increasingly define what "good" looks like everywhere.
Each use case below carries a specific classification, a specific evidence expectation and a specific supervisor in each market. AxiSentinel is configured per use case and per jurisdiction rather than shipped as one fixed pipeline.
Fintechs, asset managers and payment firms use AI to support lending, investment and fraud decisions. Each one needs a clear rationale, consistent treatment of customers and a named approver.
In 2026, financial supervisors moved from general AI principles to specific cybersecurity expectations for AI. These are the signals to plan for, as of 28 October 2026.
Explore AI Agent Security Request a Discovery and Risk Assessment
AxiSentinel does not replace model risk management or internal audit. It gives both a continuous evidence feed, and it gives the board something it currently cannot get, which is an answer to "is every model in the estate within its approved envelope right now?"
The single artefact CBUAE, MAS and RBI all ask for first, maintained continuously from what is actually running, not from a spreadsheet refreshed quarterly.
Monitoring intensity scales with model materiality, matching SR 26-2's four risk drivers and MAS's Risk Materiality Assessment rather than treating every model identically.
Ongoing, evidenced testing across protected and proxy attributes, sized for CBUAE annual bias testing, NYDFS Circular 7, Colorado quantitative testing and ECOA proxy analysis.
CCD2 and adverse-action regimes require explanations a rejected applicant can understand. AxiSentinel tests whether the explanation actually satisfies that, not merely whether one was produced.
Performance, population and concept drift with breach alerting, and the practical answer to the EU's undefined "substantial modification" threshold under grandfathering.
Detects where human review of AI-driven credit, claims or AML decisions has become rubber-stamping, the specific failure supervisors and courts find.
Evidence that override, suspend and deactivate mechanisms exist, are tested and have been exercised, explicitly required by the RBI's draft model risk guidance.
Vendor and foundation-model behavior monitored in situ, supporting DORA critical third-party duties, CBUAE audit rights and MAS's rule that governance cannot be delegated.
Observability of how agents behave in production, the class SR 26-2 excludes and no regulator has yet given a rulebook for. Hallucination, prompt injection and data-leakage detection included.
Tamper-evident, time-ordered records for internal audit, external audit, supervisory examination and DORA incident reporting, verifiable without relying on AxiLayer AI.
Adversarial input detection and model-update poisoning prevention, aligned with the ESAs' prevention, detection and management framing for frontier-AI ICT risk.
AxiSentinel runs in your own environment, cloud, on-premise, sovereign or restricted. Data stays in your environment, which supports residency requirements in the UAE, Saudi Arabia, India and China, and AxiSentinel is built to fit your outsourcing register and DORA third-party oversight.
A model estate review maps every AI and ML system you run against each regulator that supervises it, classification, evidence expectation, supervisor, deadline and gap, and shows what continuous monitoring would look like inside your own environment.
SR 26-2 replaced SR 11-7 on 17 April 2026, MAS finalized its AI Risk Management Guidelines on 7 October 2026 and the HKMA issued its ART Framework on 15 October 2026. AxiLayer AI and AxiSentinel™ extend a bank's existing three-lines-of-defense model into Always On, evidence, across the CBUAE, the ECB and EBA, the PRA, the Federal Reserve, MAS, HKMA, the RBI, APRA and every other prudential supervisor that now asks about AI.
A bank's model risk framework assumes a development-validation-approval-revalidation cycle measured in quarters. It assumes a documented model with a stable specification, a defined input space and a validator who can reproduce its output. Almost none of that holds for the AI a bank is now deploying at scale.
A fraud model retrained nightly on fresh label feedback is a different model every morning. A large language model behind a relationship manager's assistant has no stable specification and an unbounded input space. An agentic workflow reconciling exceptions takes actions rather than producing scores. And in the United States, the framework that governed all of this for fifteen years was replaced in April 2026 by guidance that is shorter, materiality-driven, expressly non-binding, and which puts generative and agentic AI outside its scope entirely while stating that existing risk management principles still apply.
AxiSentinel does not replace model risk management or internal audit. It gives both a continuous evidence feed, a live model inventory, materiality-tiered monitoring, drift and fairness alerting, and a tamper-evident record an examiner can verify without taking the bank's word for it.
The AxiSentinel™ Platform| Jurisdiction | Primary instrument | What the supervisor expects a bank to be able to show |
|---|---|---|
| UAE, CBUAE | AI & ML Guidance (23 Feb 2026); Model Management Standards & Guidance (2022) | A documented AI governance framework proportionate to size; AI risk inside enterprise-wide risk management; direct board and senior management accountability for AI outcomes; a comprehensive AI model inventory aligned to the 2022 MMS; annual bias testing on representative training data; security- and privacy-by-design; stress testing, redundancy and incident response; audit rights with immediate cessation capability; continuous monitoring and review; and regular, audit-ready reporting on AI performance and risk. |
| UAE, DIFC / ADGM | DIFC DP Law Reg. 10; DFSA and FSRA rulebooks | Records of processing by autonomous and semi-autonomous systems, human accountability and ethical-use evidence for the DIFC Commissioner (full enforcement from January 2026), plus free-zone technology, outsourcing and conduct obligations. |
| Saudi Arabia, SAMA / SDAIA | SAMA frameworks; SDAIA National AI RMF (14 Jul 2026) | Cyber security and outsourcing framework compliance, open banking obligations, and a four-phase AI risk register, context and scope, identification and assessment, treatment, and continuous monitoring and review, plus PDPL residency and transfer controls. |
| Qatar / Bahrain / Oman | QCB AI Guidelines; CBB notices; Oman National AI Policy | Qatar's QCB guidelines bind licensed financial firms directly. Bahrain's CBB has issued AI notices for open banking. Oman requires governance standards, regular assessments, documentation and compliance reports on request. |
| European Union | AI Act Annex III 5(b); DORA; CRR/CRD; CCD2; EBA Guidelines | Annex III classification for creditworthiness and credit scoring of natural persons (obligations from 2 December 2027), Annex IV technical documentation, logging and post-market monitoring, DORA ICT risk management and incident reporting, critical third-party provider mapping, and CCD2 Article 18(3) explanation, human-intervention and review rights. The EBA's mapping confirms these complement rather than duplicate existing CRD, CRR and PSD2 duties, but the mapping itself must be demonstrable. |
| United Kingdom | PRA SS1/23; FCA Consumer Duty; operational resilience | Model identification and a complete inventory, model risk governance with board-level ownership, development and validation standards including for models, and evidence that AI-driven retail outcomes satisfy the Consumer Duty, the sharpest outcomes test applied to banking AI anywhere. |
| United States | SR 26-2 / OCC 2026-13 / FDIC FIL-15-2026 (17 Apr 2026) | Six high-level principles scaled to materiality across four risk drivers, inherent risk, exposure, purpose and use; effective challenge evidenced by expertise and authority rather than reporting lines; risk-based rather than annual revalidation. Generative and agentic AI are out of scope pending a request for information, and must be governed under the bank's existing risk management principles. Fair lending under ECOA/Reg B and FCRA, and CFPB adverse-action specificity, are unaffected. |
| Canada | OSFI E-23; B-13 | Enterprise-wide model risk management extending beyond credit models, effective 1 May 2027, with technology and cyber risk obligations under B-13 and FCAC conduct expectations. |
| Singapore | MAS Guidelines on AI Risk Management (final 7 Oct 2026); FEAT; TRM | Board and senior management accountability, a cross-functional AI committee where exposure is material, an accurate inventory of all AI use cases, a Risk Materiality Assessment weighing impact, complexity and reliance, and lifecycle controls across data, fairness, transparency, explainability, human oversight, third-party risk, evaluation, monitoring and change management. Finalized on 7 Oct 2026, with core expectations applying from 7 Oct 2027 and full lifecycle expectations from 7 Oct 2028. |
| Hong Kong SAR | HKMA ART Framework (15 Oct 2026); SPM; GenA.I. Sandbox++ | Governance over generative AI in customer-facing applications, model risk and technology risk expectations under the Supervisory Policy Manual, and sandbox-grade discipline, defined use case, data boundary, success measures, risk hypotheses, customer safeguards, technical evidence, issue handling and stop conditions before live deployment. |
| India | RBI FREE-AI (Aug 2025); draft MRM guidance (24 Jun 2026) | Enterprise-wide model governance rather than credit-model-only, human oversight where AI models influence important decisions, and mechanisms to override, suspend or deactivate a model, explicit kill-switch arrangements. A broader AI framework for banks and NBFCs is under consideration covering training data, localisation, platforms, decision controls and regulatory reporting. |
| Korea & Japan | Korea AI Framework Act (22 Jan 2026); FSC guidelines; Japan FSA & AI Guidelines v1.2 | Korea: high-impact AI impact assessments, AI and AI-content notification, risk management systems, human oversight and documentation, with extraterritorial reach and a domestic representative requirement. Japan: governance against AI Guidelines for Business Ver. 1.2 and FSA supervisory dialogue, without prescriptive penalties. |
| Australia | APRA CPS 230, CPS 234, CPG 235; ASIC REP 798 | Operational risk management including critical operations and material service providers (from 1 July 2025), information security controls, data risk management, and licensee governance over AI that keeps pace with adoption, the specific gap ASIC identified. |
| Global standards | BCBS 239; Basel operational resilience; FSB; IOSCO; FATF | Risk data aggregation and lineage sufficient to trace an AI decision to its inputs, operational resilience for AI-dependent critical operations, financial-stability considerations for concentrated model and provider dependence, and AML/CFT expectations where AI drives screening and tuning decisions. |
The CBUAE's February 2026 AI and machine learning guidance is the most complete AI expectation set issued by a Gulf prudential supervisor. It applies across banks, finance companies, insurers, exchange houses and other licensed financial institutions, and it is explicit that responsibility sits with the board and senior management, not with the technology function and not with the vendor.
Read against the 2022 MMS, which already required model identification, tiering, validation, ongoing monitoring and an annual model risk report, the practical effect is that AI systems must be brought inside a framework UAE banks have been running for four years, and monitored continuously. That is precisely what AxiSentinel is designed to produce.
An EU bank faces four instruments at once, and the EBA's November 2025 mapping letter confirmed they are meant to interlock rather than stack. That is only helpful to a bank that can evidence the mapping.
The UK has no AI statute and does not need one. PRA SS1/23 sets five principles, model identification and inventory, governance, development and implementation, third-party validation, and model risk mitigants, and applies them to any model the bank relies on, including models it did not build. The FCA's Consumer Duty then tests whether the outcome was good, which no amount of documentation can substitute for.
On 17 April 2026 the Federal Reserve, OCC and FDIC replaced fifteen years of prescriptive model risk guidance with six principles, and made the whole thing expressly non-binding. For sophisticated banks this is an opportunity; for anyone with thin evidence it is exposure, because the burden of justifying the chosen approach has moved onto the bank.
Note on sources: some commentary circulating in early 2026 claimed a clarification extending the old SR 11-7 to all machine learning and agentic systems. That is inconsistent with the agencies' own published position, and we do not rely on it.
Asia Pacific is where the most operationally specific AI expectations for banks have emerged, largely because the supervisors wrote them after watching deployment rather than before.
AML and sanctions is the one banking domain where AI is already ubiquitous, already examined, and already the subject of enforcement. Supervisors do not object to machine learning in screening and monitoring; they object to a bank that cannot explain a threshold, evidence a tuning decision, or show that model changes were governed.
Each entry below is a system class we have built assessment criteria for, the regulatory hooks, the failure modes, the evidence a supervisor or validator will ask for, and the continuous controls AxiSentinel applies between reviews.
Banks use AI to support credit, pricing, capital and model decisions. Supervisors expect each bank to govern these models under its own model risk practices, and every AI-assisted decision needs a rationale that holds up in an examination.
In 2026, financial supervisors moved from general AI principles to specific cybersecurity expectations for AI. These are the signals to plan for, as of 28 October 2026.
Explore AI Agent Security Request a Discovery and Risk Assessment
AxiSentinel is live and deployable across cloud, on-premises and air-gapped environments. Access is not open for public account requests; it is by invitation only. Every threshold breach produces a Provisional Alert, which becomes a finding only on sign-off by a qualified AxiLayer AI auditor, the same effective-challenge principle a bank's own validation function operates under.
AxiSentinel carries the applicable rule set for each jurisdiction, CBUAE MMS tiers, PRA SS1/23 principles, SR 26-2 materiality drivers, MAS Risk Materiality Assessment factors, and tests against them rather than against a generic checklist.
A live inventory that reconciles what the bank has declared against what is actually running, including vendor and embedded AI. This is the single most commonly failed control in every regime above.
Automated tier proposals across inherent risk, exposure, purpose and use, mapped simultaneously to SR 26-2 drivers, CBUAE MMS tiers and MAS materiality factors, so one assessment serves several supervisors.
Population, feature and performance drift detection between validation cycles, the gap risk-based revalidation opens. Alerts carry the evidence needed to justify or revise cadence.
Recurring disparate-impact and proxy-discrimination testing on decisioning models, structured to support annual bias testing under CBUAE guidance and fair-lending analysis under ECOA and FCRA.
Reason-code generation and stability checks sufficient for CCD2 Article 18(3) explanations, GDPR Article 22 logic disclosure and US adverse-action specificity, tested for accuracy, not merely presence.
Tamper-evident, signed records of every check, alert, sign-off and model change, so a validator or examiner can verify the audit trail separately from the bank's own systems.
Measurement of whether human review is real, review time distributions, override rates, agreement patterns and escalation completeness, rather than whether a review step exists.
Monitoring of vendor and foundation-model behavior, version changes and performance shifts, supporting DORA registers, CBUAE audit rights and PRA third-party model validation.
Verification that override, suspension and deactivation actually work under load, the capability the RBI draft mandates and almost no institution has tested in production.
Structured evidence packs for DORA incident classification, CBUAE board reporting, HKMA sandbox reporting and MAS oversight forums, generated from the same underlying record.
Compliance Passport status follows continuing conformance, so it changes to UNDER REVIEW or WITHDRAWN when monitoring fails.
| Deliverable | Contents |
|---|---|
| Model Estate Discovery | Reconciled inventory of AI and model assets including vendor, embedded and shadow deployments, with owner, tier proposal, jurisdictional classification and evidence status per asset. |
| Multi-Jurisdiction Gap Assessment | Control-by-control gap analysis against every regime the institution is exposed to, deduplicated so a single control satisfies several supervisors where the requirements genuinely coincide. |
| Materiality & Tiering Report | Proposed tiers with rationale mapped to SR 26-2 drivers, CBUAE MMS tiers, MAS materiality factors and PRA SS1/23 principles, ready for model risk committee approval. |
| EU High-Risk Readiness Pack | Annex III classification opinion, Annex IV technical documentation gap list, logging and post-market monitoring design, and fundamental rights impact assessment scoping ahead of 2 December 2027. |
| Consumer Outcome Testing | Fairness, explainability and vulnerable-customer testing structured for FCA Consumer Duty, CCD2 and fair-lending evidence, with reproducible methodology. |
| AML/CFT Model Review | Tuning and threshold documentation review, above/below-the-line evidence assessment, coverage mapping and alert-quality analysis. |
| Model Assurance | Vendor and foundation-model assessment, contractual audit-right and cessation review, DORA register support and concentration analysis. |
| GenAI & Agentic Control Design | Control set for the classes SR 26-2 leaves out of scope, grounding, disclosure, action boundaries, reversibility, dual control and kill-switch verification. |
| Continuous Monitoring Deployment | AxiSentinel instrumentation with materiality-tiered thresholds, Provisional Alert routing to the second line, and auditor sign-off workflow. |
| Validation Support | External effective challenge on tiered models, delivered to a standard consistent with SR 26-2's expertise-and-authority test rather than an org-chart test. |
| Board & Committee Reporting | Quarterly model risk and AI risk reporting packs, plus the annual model risk report format UAE institutions require under the MMS. |
| Examination Readiness | Evidence packs organized by supervisor and by request type, with the cryptographic chain available for verification. |
| Remediation Roadmap | Sequenced, costed remediation plan ordered by regulatory deadline and residual risk, with owner and evidence target per item. |
One model estate, every supervisor the institution answers to, deduplicated into a single control set, then monitored continuously between validation cycles.
Diagnostic imaging, sepsis prediction, ambient clinical documentation, prior authorization, drug discovery and patient-facing chatbots now operate under the densest overlap of device law, data law, AI statutes and accreditation standards of any industry, and the bodies behind all four changed their expectations materially across 2025 and 2026. AxiLayer AI and AxiSentinel™ give health systems, payers, device and SaMD makers, pharma and health-AI vendors in the UAE and GCC, the European Union, Asia-Pacific, the UK and North America continuous evidence that every model touching a patient is still safe, fair and within its approved envelope. The FDA has now authorized more than 1,600 AI-enabled medical devices, and California’s AB 1979 and SB 503 set new rules for clinical AI from 1 January 2027.
Across late 2025 and 2026, healthcare regulators, legislatures and accreditors converged on the same demand from different directions: not proof that an algorithm was validated once, but proof that someone is watching it now that it is treating patients.
The FDA has authorized more than 1,600 AI-enabled devices, overwhelmingly via the 510(k) pathway on retrospective and often single-site data, and its lifecycle-management guidance for AI devices, drafted in January 2025, remains unfinalized. Meanwhile most clinical AI, EHR-embedded deterioration scores, ambient scribes, generative assistants, never passes through device review at all. Performance at your site, on your population, after the vendor’s next update is nobody’s approval and everybody’s liability. That is a monitoring problem, not a documentation problem.
Health-AI vendors preparing for procurement and health-system due diligence are covered in depth on the dedicated vendor assessment page.
Go to Vendor AssessmentsA single deterioration model or triage chatbot deployed across a multinational provider group can simultaneously be an FDA-regulated device function in the US, an Annex I high-risk system under the EU AI Act, a high-impact system under Korea’s AI Framework Act, and subject to the DoH Abu Dhabi AI policy, while the data feeding it answers to HIPAA, GDPR, the EHDS and Gulf residency rules. Each regime wants different evidence in a different format. This is the coverage map.
The Gulf pairs the region’s earliest health-AI rulebook with the world’s densest live deployment surface, emirate-scale health information exchanges running AI across entire populations.
US health AI answers to a device regulator, a privacy enforcer, an EHR certification program, fifty legislatures and an accreditor, and in 2025 to 26 all five moved.
Medical AI in Europe is a dual-conformity problem: the same system must satisfy the MDR or IVDR and the AI Act, assessed by notified bodies that are already the system’s scarcest resource.
Three regulators reforming device law for AI without an AI act: sandbox-driven in the UK, guidance-led in Canada, framework-review-led in Australia.
Asia-Pacific holds both the strictest binding classification of health AI (Korea) and the most operationally specific lifecycle guidance (Singapore), with the region’s largest device markets accelerating approvals underneath.
No treaty governs health AI, but a recognizable global baseline now exists, and every national regulator on this page cites some part of it.
Each use case below carries a specific classification, a specific evidence expectation and a specific supervisor, or accreditor, in each market. AxiSentinel is configured per use case and per jurisdiction rather than shipped as one fixed pipeline.
Hospitals and health systems use AI to support care pathways, capacity planning and technology purchases. Each recommendation that shapes patient care needs a clear rationale, a named approver and a review when evidence changes.
Clinical AI handles the most sensitive data there is, and a manipulated or leaking system can harm patients and trust at once. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
AxiSentinel does not replace clinical governance, quality committees or regulatory affairs. It gives all three a continuous evidence feed, and it gives the board something it currently cannot get, which is an answer to “is every model touching a patient still performing, here, today?”
The first ask of the Joint Commission, CHAI, AIHGle 2.0 and Korea’s Act alike, maintained continuously from what is actually running, including EHR-embedded models switched on by default.
Continuous local validation evidence per deployment site and per population, the answer to models approved on someone else’s data, and the practical watch on the EU’s undefined “substantial modification” threshold.
Ongoing, evidenced testing across demographic groups, age, sex, ethnicity, payer class and site, sized for CHAI expectations, EU fairness duties and the risk-score failure modes the literature documents.
Evidence that HTI-1’s 31 source attributes, Korea’s explanation duties and Article 50 disclosures are present, accurate and current, not merely that they were written once.
Detects alert fatigue, override anomalies and rubber-stamped physician review, the specific failure SB 1120 legislates against and every clinician-in-the-loop regime assumes away.
Evidence that every model update stayed inside its predetermined change control plan, FDA’s final guidance of December 2024, the UK’s draft 2026 equivalent and Korea’s pre-approved change plans.
Incident, trend and performance records shaped for MDR/IVDR post-market surveillance, the GB PMS regulations and the FDA’s lifecycle expectations, generated continuously, not reconstructed at audit.
AxiSentinel runs inside your own environment, cloud, on-premise or fully air-gapped, which supports HIPAA, GDPR, EHDS and Gulf health-data residency requirements. Patient data stays inside your environment or your in-region instance, with a Business Associate Agreement and Data Processing Agreement for every engagement.
Hallucination and omission detection for scribes and clinical copilots, disclaimer compliance under AB 3030, and the device-boundary evidence MHRA’s ambient voice guidance now expects.
Most hospital AI is bought, not built, and every regime on this page makes the deployer accountable anyway. Vendor and foundation-model behavior is monitored in situ, in your environment.
Tamper-evident, time-ordered records for accreditation surveys, notified bodies, FDA inspections and internal quality committees, verifiable without relying on AxiLayer AI.
Evidence that deactivation and rollback mechanisms exist, are tested and have been exercised, the last line of defense when a clinical model drifts, and the first question after an incident.
A clinical AI estate review maps every model touching patients or claims, bought or built, device or not, against each regulator, statute and accreditor that supervises it: classification, evidence expectation, deadline and gap, and what continuous monitoring would look like inside your own environment, including fully air-gapped.
Autonomy, ISR, battle management, cyber defense and generative staff assistants are being fielded faster than any defense ministry can test them, while acquisition rules, alliance principles and multilateral norms all now demand evidence of human judgment, tested envelopes and controlled technology. AxiLayer AI and AxiSentinel™ give primes, defense-tech vendors and government programs across the United States, NATO and the European Union, the United Kingdom, the UAE and GCC, and Asia-Pacific continuous TEVV and compliance evidence, including fully air-gapped and restricted deployment. This is an assurance and compliance practice: we evaluate and evidence AI systems; we do not develop weapons. The CCW Review Conference on autonomous weapons meets in Geneva from 16 to 20 November 2026.
Between May 2025 and November 2026, defense AI governance moved on three fronts at once: acquisition rules made cyber and AI evidence a condition of contract, alliance and national budgets made autonomy the fastest-growing spend line, and the multilateral track set an explicit deadline. Each front asks for the same thing, proof.
Adoption is outrunning the capacity to test it. GAO found federal AI use cases nearly doubled from 571 in 2023 to 1,110 in 2024, while its reviews of the DoD AI workforce (GAO-24-105645) echo the National Security Commission on AI's finding that the talent deficit, above all in test and evaluation, is among the greatest impediments to AI readiness. NATO's Alliance-wide TEV&V landscape is still being assembled. And the Replicator dispute, thousands of systems declared fielded in August 2025, hundreds counted by the Congressional Research Service, shows what happens when capability claims outrun evidence. That gap is precisely what a continuous evidence chain closes.
Everything here is defensive: testing, evaluation, governance and compliance of AI already in or entering service. AxiLayer AI does not design, develop or advise on weapons.
CAGE 20JV1 · UEI CB76ENDLMUC9 · SAM.gov active for all award types. AxiSentinel is designed to run in disconnected and restricted environments.
Government ProfileA single autonomy stack can simultaneously face a 3000.09 senior review in the United States, NATO's Principles of Responsible Use in a coalition deployment, JSP 936 in a UK program, an Article 36 legal review before fielding, ITAR licensing on export and a sovereign air-gap requirement in the Gulf. Each regime wants different evidence in a different format. This is the coverage map.
The world's largest defense AI buyer now runs an AI-first innovation enterprise on one side and a contract-clause compliance regime on the other. Vendors must satisfy both.
NATO sets the responsible-use baseline for 32 Allies; the EU funds the industrial base while its AI Act draws a military exclusion line that is narrower than most vendors assume.
The UK is the first ally to turn defense AI ethics into a numbered directive with auditable "musts", which makes it the clearest preview of where allied assurance expectations are heading.
The Gulf is building sovereign defense AI at speed, and every step of it runs through US export-control and security-assurance conditions. Localisation plus tech transfer equals a compliance-evidence market.
The Indo-Pacific is institutionalising military AI four different ways at once: trilateral interoperability, formal ethics directives, dedicated R&D centers and startup pipelines.
None of this layer is a contract clause, yet it defines what "responsible" means in every allied procurement, and export-control law makes parts of it very binding indeed.
Each use case below carries a specific governing instrument, a specific evidence expectation and a specific review gate. AxiSentinel is configured per use case and per program, in your environment, rather than shipped as one fixed pipeline.
Defense programs are adopting agentic AI that works across digital engineering data, from system models to digital twins, and turns complex engineering and acquisition questions into recommendations. The faster those decisions move, the more each one needs a record that holds up in review.
Defense AI is a priority target: adversaries want to poison mission data, steal models and fool sensors. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
AxiSentinel does not replace program test organizations, operational test agencies or legal review. It gives all of them, and the oversight bodies above them, a continuous evidence feed from the fielded system itself, designed to run in disconnected and restricted environments.
AxiSentinel is designed to run in your own environment, cloud, on-premise, sovereign or fully disconnected, including air-gapped and restricted environments. Controlled data stays inside the program's own authorized environment. No telemetry leaves it.
Test-to-field traceability: the certified envelope, the evidence behind it, and continuous confirmation that the fielded system is still inside it, the artefact NATO's TEV&V landscape and DoD test policy both point to.
Documented, time-ordered records of where humans decide, override and abstain, aligned to DoDD 3000.09's appropriate-human-judgment standard and the Political Declaration's oversight measures.
Full lineage for models, weights, training and update data, including supply-chain integrity and model-update poisoning defense for systems retrained in theatre.
Performance, population and concept drift against the tested envelope for every fielded model, the difference between "it passed the range test" and "it is still passing, today".
Structured adversarial testing records and detection of adversarial inputs in operation, retained as evidence for accreditation and re-accreditation decisions.
Monitoring pipelines architected for CMMC and NIST SP 800-171 boundaries, so the assurance layer never becomes the compliance breach.
Documented classification of dual-use models against ITAR/EAR categories, plus end-user and controlled-access evidence for security-conditioned approvals such as the 2025 GCC frameworks.
Hallucination, data-leakage and prompt-injection monitoring for LLM assistants at GenAI.mil scale, with evidence packs sized for internal oversight rather than screenshots.
Structured capture of unintended behavior, near-misses and out-of-envelope events, routed to program, safety and legal channels with full context preserved.
Time-ordered evidence verifiable without relying on AxiLayer AI, suitable for inspectors general, parliamentary and congressional oversight, and Article 36 legal reviews.
Per-version assurance artefacts that travel with a model when it is exchanged between allies, the missing piece in AUKUS-style model interchange and NATO federated deployments.
Everything above assumes a system has already been built and fielded. Acquisition and engineering decisions upstream of that point, the trade studies, milestone reviews and refresh-cycle revisions that decide what gets built, carry the same evidentiary burden and are usually the least auditable step in the program. GAO found that major weapon-system milestone reviews can consume roughly 5,600 staff days of documentation per program, routed through as many as 56 organizations across eight review layers (GAO-15-192), while the program managers who live through it credit only about 10 percent of that paperwork with adding real value. What survives is rarely the rationale, it is the slide deck; the assumptions, weights and bias checks behind a recommendation are almost never versioned, and when the engineer who made the call rotates out, so does the reasoning.
AxiSentinel™'s signed, tamper-evident evidence extends to this layer: objectives, options, constraints, assumptions, risks and bias checks become versioned, testable records instead of prose, built to interoperate with the Digital Engineering ecosystem the Army is migrating toward SysML v2 under transition guidance from the Office of the Under Secretary of War for Research and Engineering.
Objectives, options, constraints, assumptions, risks, bias checks and evidence as versioned, owned, testable records, not slide text, so a recommendation can be checked years after the fact.
Import and export through the OMG Systems Modeling API and SysML v2 textual notation, with trace links from requirements and parts to the objectives and constraints they feed.
Elicitation, planning, evidence retrieval, challenge and document-validation agents operate under human approval gates at framing, weights, evaluation and sign-off, never autonomously.
Scoring and uncertainty analysis run outside the AI model, so replaying the same inputs always produces the same ranking.
For every result, the smallest change in a weight, score or assumption that would overturn the top-ranked option, so reviewers see which inputs actually matter.
A single trade study or a multi-episode program revisited across refresh cycles, each episode inheriting prior state with full lineage of what changed and why.
Recommendation, rationale, flip table, assumptions register, risk register, bias-check results and dissent, packaged and signed the same way AxiSentinel signs monitoring evidence.
Anchoring, confirmation, sunk cost, availability, groupthink and post-hoc weight manipulation each run as a pass or fail procedure before a package can be signed.
A defense AI assurance review maps one program against every instrument that touches it, 3000.09, CMMC, JSP 936, NATO PRUs, Article 36, export controls, and shows exactly which evidence exists, which is missing, and what continuous monitoring would look like inside your own enclave.
The companies that build AI are now the companies most regulated by it. GPAI and foundation-model providers, SaaS platforms embedding AI features, systems integrators and the enterprises deploying all of the above face provider duties in the EU, four new US state laws that took effect on a single day, Asia-Pacific's first comprehensive AI statute, and a mandatory labeling regime in China, nearly all of it arriving between February 2025 and August 2026. AxiLayer AI and AxiSentinel™ give technology companies and enterprise AI programs in the UAE and GCC, the European Union, the United States, Asia-Pacific and the UK continuous evidence of what every model, feature and agent in the estate actually did, mapped to the regime that governs it.
Between December 2025 and August 2026, the world's three largest technology markets each crossed a line: from principles to enforcement in the EU, from a proposed federal moratorium to a live state-law patchwork in the US, and from filings to mandatory labeling in China, while Korea gave Asia-Pacific its first comprehensive AI statute and agentic AI outran every framework written for it.
Enterprises deployed autonomous agents years before any regulator wrote a rulebook for them. Every statute on this page was drafted for models that answer; agents act, they execute transactions, chain tools and modify systems at a speed no human review cycle matches. Add the provider-versus-deployer trap, fine-tune a model or substantially modify a system and you may inherit the full provider obligation set, and defensible governance for an acting system is continuous observation of what it actually did, with a qualified human between detection and finding.
Vendors selling AI into regulated buyers, and the enterprises assessing them, are covered in depth on the vendor assessment page.
A single AI feature shipped globally can be a GPAI-derived system under the EU AI Act, a generative AI service requiring output labeling in China and advance notice in Korea, a training-data disclosure obligation in California, and an autonomous system under DIFC Regulation 10, with the provider-or-deployer question answered differently in each market. This is the coverage map.
The Gulf regulates enterprise AI through national strategies, charters, free-zone rules and procurement rather than an AI act, and it is simultaneously the fastest-growing sovereign compute market on earth, which makes deployment architecture a compliance question in its own right.
For technology companies the AI Act is three regimes in one, GPAI provider duties already enforceable, high-risk provider duties arriving December 2027, and deployer duties for every enterprise using AI, sitting on a data, cyber and platform acquis that binds regardless.
Federal policy pushes acceleration, EO 14179 (January 2025), America's AI Action Plan (23 July 2025, 90+ actions), and the AI Safety Institute reborn as the pro-innovation CAISI (June 2025), while the states legislate faster than Washington can sue them.
China governs AI through layered, binding measures enforced by the CAC rather than a single act, and market access runs through filings. For any technology company serving Chinese users, labeling conformance is now a technical specification, not a principle.
Asia-Pacific now spans the full spectrum, from Korea's binding, extraterritorial statute to Singapore's world-leading testing toolkits, and it is where the largest volume of new enterprise AI deployment is happening.
The UK stayed statute-free and built an assurance market instead, and the ISO/IEC 42000 series is quietly becoming the common denominator every other regime maps onto, which makes it the closest thing enterprise AI has to a global passport.
Each use case below carries a specific role classification, a specific evidence expectation and a specific regulator in each market. AxiSentinel is configured per use case and per jurisdiction rather than shipped as one fixed pipeline.
Technology companies are deploying AI agents that plan work, compare options and make recommendations inside products and operations. Customers, auditors and regulators increasingly ask how those decisions were reached and who approved them.
AI products ship fast and connect to everything, so security gaps travel to every customer at once. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Enterprise AI estates are assembled, not built: foundation models behind APIs, fine-tunes on top, SaaS features beside them, agents orchestrating all of it. AxiSentinel gives technology companies and enterprise deployers one continuous evidence layer across every role they hold in every market, and gives the board an answer to "which of our AI systems changed today, and under whose rules?"
Maintained continuously from what is actually running, including shadow AI discovery, the first artefact the EU, Korea, SDAIA and every enterprise auditor asks for.
Evidence of which role you hold per system, per market, and alerts when fine-tuning, rebranding or modification is about to change the answer.
Each use case mapped against Annex III categories, Korea's high-impact domains, Colorado's consequential decisions and TRAIGA's prohibited uses, kept current as the deadlines move.
Continuous support for Article 53 technical documentation, the AI Office training-content template, AB 2013 disclosures and Korea's training-data summaries, kept in sync with what the model actually is.
Automated checks that chatbot disclosures, machine-readable marks and visible labels actually appear and survive processing, across the EU, China GB 45438-2025 and Korea schemas at once.
What each agent did, which tools it called, where it exceeded its envelope, the continuous monitoring, circuit-breaker evidence and rollback records analysts say agent governance requires.
Performance, population and behavioral drift with breach alerting, the practical answer to the EU's undefined "substantial modification" threshold for grandfathered and continuously shipped systems.
Ongoing, evidenced testing sized for Illinois HB 3773, NYC Local Law 144 audits, Colorado's ADMT duties and the EU's Annex III employment category.
Detection, timelines and artefacts for EU serious-incident duties, SB 53's 15-day critical-incident reports, RAISE Act protocols and CRA reporting from September 2026.
Foundation-model and vendor behavior monitored in situ, upstream changes detected before they silently change your compliance position downstream.
Tamper-evident, time-ordered records for regulators, enterprise customers, certification bodies and courts, verifiable without relying on AxiLayer AI.
AxiSentinel runs in your own cloud, on-premise or sovereign environment, including fully air-gapped estates. Data stays in your environment, which supports residency rules in the UAE, Saudi Arabia, China and India. It runs on whatever cloud you build on, and moves with you when you change providers.
An AI estate review maps every model, feature and agent you build or deploy against each regime that governs it, role, classification, evidence expectation, regulator, deadline and gap, and shows what continuous monitoring would look like inside your own environment, including air-gapped.
Grid dispatch, water treatment, traffic control, rail signaling, air traffic operations and city-scale platforms are no longer piloting AI, they are running on it. In 2025 and 2026 the regulators of physical systems caught up: the EU fixed a hard high-risk deadline for critical-infrastructure AI, Korea put energy, water and transport under statutory high-impact duties, US grid authorities began writing mandatory rules for AI-scale loads, and autonomous transport moved from trial permits to commercial exemptions. AxiLayer AI and AxiSentinel™ give operators across the UAE and GCC, the European Union, the UK, North America and Asia-Pacific continuous evidence that the AI now touching their control loops is still behaving as designed.
Infrastructure regulators spent a decade treating AI as an efficiency program. Between late 2025 and mid-2026 they reclassified it as a safety component, in statute, in reliability standards and in permit conditions. Five developments define the new baseline.
AI has moved from dashboards into control loops. A mispriced loan is financial and reversible; a mis-dispatched feeder, a mistimed signal phase or a wrong coagulant dose is physical, immediate and sometimes irreversible. Yet most infrastructure operators cannot today produce an inventory of which models actually influence physical actuation, let alone evidence that each one is still inside its safety envelope. Every regime on this page, Annex III, Korea's high-impact duties, NERC's new standards, the ADS regulations, converges on exactly that evidence.
A single dispatch, traffic or treatment model deployed by a multinational operator can be simultaneously an Annex III safety component in the EU, a high-impact system under Korea's AI Framework Act, part of a SOCI-regulated asset in Australia and inside the perimeter of NERC's new computational-load standards in the US, while the entity running it answers to NIS2, the CER Directive and a national cyber agency. Each regime wants different evidence in a different format. This is the coverage map.
The Gulf is not merely regulating AI in infrastructure, it is building the world's largest sovereign AI-infrastructure program while standing up the region's first AI trust certifications, and it expects suppliers to arrive with evidence.
The EU now regulates infrastructure AI from four directions at once: AI-specific classification, cyber resilience of the entity, physical resilience of the asset, and product security of every device with digital elements. The four regimes interlock by design.
Federal AI-specific policy softened in 2025, the sector regulators did not. Grid, pipeline, water and transport authorities all tightened through 2025 to 26, and the grid regulator now writes rules for AI's own electricity demand.
The UK regulates AI in infrastructure through cyber resilience law, transport statute and grid policy rather than an AI act, and its cyber agency has been the bluntest in the world about what AI does to critical-infrastructure risk.
Asia-Pacific hosts both the strictest AI-in-infrastructure statute in force anywhere and the most mature OT security regimes, a combination that makes per-market evidence packs unavoidable for regional operators.
Autonomy went from national experiments to global rulebooks in eighteen months, and every one of the new instruments demands the same thing: a safety case backed by continuous in-service monitoring.
Each use case below sits at a different distance from physical actuation, and that distance determines which regime bites, Annex III point 2 for safety components, NIS2 and SOCI for the entity, sector directives for the asset, and transport-specific instruments for anything that moves. AxiSentinel is configured per use case and per jurisdiction rather than shipped as one fixed pipeline.
Cities and infrastructure owners use AI to prioritize capital projects, maintenance and services. Public decisions need a rationale that residents, auditors and councils can follow.
AI now sits close to physical operations, where a manipulated input can become an unsafe action. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Infrastructure AI cannot be assured from someone else's cloud. AxiSentinel deploys inside your own environment, including fully air-gapped and OT-isolated networks, and produces the evidence every regime on this page now asks for: what is running, whether it is inside its envelope, and who signed off.
A continuously maintained register of every model and agent that reads from or writes to control systems, the first artefact Annex III classification, Korea's impact assessments and SOCI reviews all require.
Control-adjacent models monitored against their approved operating envelope, with drift and distribution-shift detection, and the practical answer to the EU's undefined "substantial modification" threshold for continuously retrained systems.
Documented, time-stamped proof that operator-in-the-loop review is real rather than rubber-stamped, the specific expectation in Korea's high-impact duties, Annex III Article 14 and every control-room deployment.
Evidence that fallback modes, manual override and disconnection paths exist, are tested and have been exercised, the difference between claiming a fail-safe and proving one.
Evidence collection and transfer for OT-isolated and air-gapped networks, no cloud dependency, no standing connection into the control network, consistent with the December 2025 OT-AI principles.
Detection of anomalous, spoofed or poisoned inputs to forecasting and control models, the attack class ENISA documented against AI supply chains in 2025.
Time-ordered incident artefacts sized for NIS2's 24-hour early warning and 72-hour notification, SOCI reporting windows and TSA's CISA-reporting directives.
One monitoring record, many formats: the same evidence base feeds an Annex III technical file, a NERC audit, a SOCI vulnerability assessment and a Korean impact assessment without re-instrumenting.
Continuous in-service monitoring aligned with ISO/PAS 8800's AI safety lifecycle and the UNECE ADS GTR, the evidence layer a robotaxi, rail or maritime autonomy safety case now has to cite.
Observability and guardrail monitoring for copilots and agents in SOCs and control rooms, hallucination, prompt-injection and scope-escape detection before an assistant's suggestion becomes an operator's action.
Tamper-evident, time-ordered records for regulators, insurers and boards, verifiable without relying on AxiLayer AI, and durable across the multi-year timescales infrastructure regulation runs on.
Evidence mapped per market, EU Annex III and NIS2, US sector directives, UK CAF, Korea's K-Act, GCC frameworks, so one deployment serves every supervisor an operator answers to.
An infrastructure AI review maps every model and agent that touches your physical operations against each regime that governs it, classification, evidence expectation, supervisor, deadline and gap, and shows what continuous monitoring looks like inside your own environment, including the networks that never touch the internet.
AxiSentinel finds and controls AI agents, with continuous compliance evaluation, from software to embodied systems: industrial robots, collaborative robots, autonomous mobile robots, and humanoid platforms operating in the physical world, not just in the cloud. Robots that learn on the floor are Adaptive Intelligence (AdI): their behavior is baselined, re-tested and contained as it changes.
For most of the last two decades, robot safety was a mechanical-engineering discipline: force limits, e-stops, guarding. That changed the moment regulators started asking what happens when the robot's behavior comes from a model instead of a fixed program.
Every continuous AI-monitoring platform built so far was built for models that run in a data center. None of them were built to evaluate a robot that can share a floor with a person.
Physical AI sits at the intersection of machinery law and AI law. AxiSentinel tracks both, and builds RegDef packages the moment a standard is stable enough to evaluate against.
Industrial robot safety, now absorbing the former ISO/TS 15066 collaborative-robot thresholds directly into the main standard.
Replaces the 2006 Machinery Directive outright and, for the first time, explicitly brings AI-based safety functions and self-evolving code into scope.
Added 28 Jul 2026. A procurement and import restriction targeting specific foreign-made robot categories, not yet an operational compliance rule for deployers.
Successor to ISO 13482:2014, the baseline personal-care and service-robot safety standard, currently at Final Draft International Standard stage.
Formally titled "Collaborative Safety, Physical Contact with Robots, Part 1: Biomechanical Thresholds and Data" on ISO's work program. A dedicated successor to the collaborative-robot force and pressure guidance now folded into ISO 10218, expanding it into its own standard.
General-purpose AI risk-management frameworks that already apply to any AI component inside a robotic system, physical embodiment or not.
From a single cobot on a factory floor to a fleet of humanoid platforms, AxiSentinel evaluates physical-AI behavior against whichever standard actually applies.
Robot makers and integrators use AI to choose components, control strategies and deployment settings. When a machine works near people, the reasoning behind those choices matters as much as the result.
A robot acts in the physical world, so an attack on its AI can become a safety event. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel's core architecture changes for embodied systems. What changes is which RegDef packages are switched on and what telemetry the agents capture.
Agents capture robot and fleet telemetry on the cadence you configure, Always On or scheduled, in full rather than sampled, and never limited to a quarterly cycle.
Every telemetry event evaluated against the applicable physical-AI safety and machinery rule set, per AI event.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, verifiable from the first event.
A compliance state change on one robot or an entire fleet propagates network-wide as it happens.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it.
AxiSentinel can run on industrial control networks, mobile robot fleets, and fully air-gapped facilities, zero network connectivity required.
Tracks human involvement in autonomous physical actions and feeds it into AxiSentinel's oversight-gap scoring model.
The same agents generating compliance evidence watch for manipulated sensor inputs, spoofed perception data, and poisoned model updates before a re-tested release reaches production.
New machinery, robotics, or jurisdictional rules are added by encoding new RegDef packages. Deployed agents are never rebuilt.
Scoped to your organization during onboarding, not hard-coded into the platform.
A threshold breach becomes a flagged, timestamped, evidence-linked Provisional Alert, reviewed by a qualified AxiLayer AI auditor before anything counts as a finding.
The same architecture monitoring a warehouse robot fleet monitors a trading desk's model or a hospital's diagnostic AI. What changes is which RegDef packages are switched on.
Whether it's a single collaborative robot or a fleet of humanoid platforms, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
On June 24, 2026, UNECE adopted the first global technical regulation for automated driving systems, GTR No. 26, together with UN Regulation No. 185, co-sponsored by Canada, China, the European Commission, Japan, the UK, and the US. AxiSentinel evaluates autonomous vehicle software and safety-case evidence continuously, against whichever jurisdiction's rules actually apply to a given deployment.
Autonomous vehicles have spent a decade being regulated country by country, sometimes state by state. That era is ending: the world's largest vehicle markets just agreed on one definition of a safe automated driving system.
A safety-management-system audit happens once, at type approval. AxiSentinel is built for what happens in the months and years between audits, while the vehicle is actually on the road.
A vehicle sold globally now has to satisfy a shared international baseline plus whatever each market layers on top. AxiSentinel tracks both levels.
Formally adopted as UN GTR No. 26, paired with UN Regulation No. 185. The first global technical regulation of its kind, endorsed by Canada, China, the EU, Japan, the UK, and the US. Requires audited safety-management systems, credible test environments, and continuous post-deployment monitoring.
The first dedicated AI-safety framework for road vehicles, addressing how AI components inside a vehicle's software stack should be developed and assessed.
China's first mandatory national standard for Level 3 and Level 4 automated driving systems, GB 44721-2026, aligned with the UN GTR for international harmonization.
In force since 15 May 2026, governing permits for automated passenger services ahead of the full Automated Vehicles Act framework targeted for 2027.
State-level permitting frameworks specific to autonomous vehicle operation, confirmed in force and distinct from existing state AI-transparency statutes. At the federal level, NHTSA withdrew its AV STEP proposed rule on 26 June 2026, citing expected minimal participation in a voluntary program; the agency is pursuing its automated-vehicle safety goals through existing exemption and crash-reporting programs instead.
General-purpose AI risk-management frameworks that already apply to any AI component inside an autonomous vehicle's software stack.
From a single ADAS feature to a fleet of Level 4 robotaxis, AxiSentinel evaluates the software and safety-case evidence continuously, not just at type approval.
AI now helps engineering teams compare architectures, sensor suites and software options during vehicle development. ISO/PAS 8800 sets expectations for the safety of AI in road vehicles, and every AI-assisted design choice becomes part of the safety argument.
Vehicle AI must keep working safely when someone is actively trying to fool or reach it. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel's core architecture changes for autonomous vehicles. What changes is which RegDef packages are switched on and what telemetry the agents capture from the vehicle or fleet.
Agents capture vehicle and fleet telemetry on the cadence you configure, Always On or scheduled, in full rather than sampled, and never limited to a quarterly cycle.
Every telemetry event evaluated against the applicable automated-driving rule set, per AI event.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, verifiable from the first event.
A compliance state change on one vehicle or an entire fleet propagates network-wide as it happens.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it.
AxiSentinel can run on vehicle compute, mobile networks, and telecom network functions, with an offline option for isolated environments.
Tracks human involvement in remote supervision and teleoperation decisions and feeds it into AxiSentinel's oversight-gap scoring model.
The same agents generating compliance evidence watch for spoofed sensor inputs, adversarial perception attacks, and poisoned model updates before a re-tested release reaches production.
New vehicle, jurisdictional, or GTR-aligned rules are added by encoding new RegDef packages. Deployed agents are never rebuilt.
Scoped to your organization during onboarding, not hard-coded into the platform.
A threshold breach becomes a flagged, timestamped, evidence-linked Provisional Alert, reviewed by a qualified AxiLayer AI auditor before anything counts as a finding.
The same architecture monitoring a robotaxi fleet monitors a trading desk's model or a hospital's diagnostic AI. What changes is which RegDef packages are switched on.
Whether it's a single ADAS feature or a fleet of Level 4 robotaxis, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
On June 22, 2026, the President signed two quantum executive orders, and EO 14412 set hard federal deadlines for post-quantum cryptography: key establishment by December 31, 2030 and digital signatures by December 31, 2031. AxiSentinel evaluates whether an organization's AI systems, evidence chains, and infrastructure meet the cryptographic standard each deadline actually requires.
For 30 years, RSA and elliptic-curve cryptography protected everything from TLS sessions to signed audit records. A sufficiently powerful quantum computer breaks both. The government's answer arrived not as a single law but as a stack of deadlines, standards, and acquisition rules, most of them binding now, some on a clock that starts the day a system is built, not the day it's attacked.
A cryptographic inventory is a point-in-time spreadsheet. AxiSentinel is built for the years between now and 2030, while migration is actually happening system by system.
From NIST's finalized standards to the executive orders enforcing them, AxiSentinel tracks the full stack of quantum-security obligations bearing down on AI infrastructure.
The finalized key-encapsulation and digital-signature standards every federal PQC deadline is measured against.
Signed June 22, 2026. Directs federal agencies and their contractors onto a hard PQC migration schedule running through 2031.
The NSA's phased quantum-safe timeline for National Security Systems, with the first acquisition deadline already in force.
All remaining FIPS 140-2 certificates moved to Historical status on September 21, 2026; only FIPS 140-3-validated cryptographic modules are acceptable for new federal procurement.
Requires federal agencies to inventory IT systems vulnerable to quantum decryption and prioritize migration once NIST standards are published, the standards are now published.
Commission Recommendation (EU) 2024/1101 (11 April 2024), operationalized by the NIS Cooperation Group's roadmap. Non-binding on member states but sets the EU-wide reference timeline.
Published 20 March 2025 by the National Cyber Security Centre. Not mandatory, but the reference timeline UK organizations are measured against.
General-purpose AI risk-management frameworks that already apply to any AI system whose cryptographic posture is part of its own risk profile.
From a single cryptographic module to an entire federal system portfolio, AxiSentinel evaluates the software and evidence continuously, not just at audit time.
Organizations use AI to inventory cryptography, prioritize post-quantum migration and plan quantum investments. Federal migration timelines make these long-running decisions that must be revisited as standards and threats change.
Quantum progress threatens the encryption that protects AI models, training data and signed evidence today. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel's core architecture changes for post-quantum evidence. What changes is which RegDef packages are switched on and what telemetry the agents capture from a system's cryptographic configuration.
Agents capture cryptographic-configuration and key-management telemetry on the cadence you configure, Always On or scheduled, in full rather than sampled, and never limited to a quarterly cycle.
Every telemetry event evaluated against the applicable post-quantum standard, per configuration change.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, verifiable from the first event.
A compliance state change on one system or an entire portfolio propagates network-wide as it happens.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it.
AxiSentinel can run on isolated federal and defense networks, with an offline option for environments with no external connectivity.
Tracks human involvement in migration decisions and sign-off, feeding into AxiSentinel's oversight-gap scoring model.
The same agents generating compliance evidence watch for weak-algorithm fallback, misconfigured hybrid deployments, and unauthorized use of deprecated ciphers before a re-tested release reaches production.
New standard, deadline, or jurisdiction-specific rules are added by encoding new RegDef packages. Deployed agents are never rebuilt.
Scoped to your organization during onboarding, not hard-coded into the platform.
A threshold breach becomes a flagged, timestamped, evidence-linked Provisional Alert, reviewed by a qualified AxiLayer AI auditor before anything counts as a finding.
The same architecture monitoring a cryptographic migration monitors a trading desk's model or a hospital's diagnostic AI. What changes is which RegDef packages are switched on.
Whether it's a single cryptographic module or an entire federal system portfolio, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
Colorado, California, Montana, Connecticut, and Vermont now classify neural data as sensitive personal data, and nine more bills landed across six states in the first six weeks of 2026 alone. AxiSentinel evaluates neurotechnology and AI systems that process brain data against whichever state's rules actually apply.
Neural data, brainwave, EEG, and other signals recorded from a consumer neurotechnology device, didn't exist as its own legal category before 2024. It now sits inside the same fast-moving state-by-state pattern AxiLayer already tracks for general AI law: each state defines it slightly differently, gives individuals a private right of action, and moves faster than any single federal rule.
A privacy-policy review happens once, at launch. AxiSentinel is built for what happens after: continuous evidence that a neurotechnology product's actual data handling matches whichever state's law applies to each user.
No US federal neural-data law exists yet, but the state patchwork is not the whole picture. Chile has given brain data constitutional protection since 2021, UNESCO adopted the first global ethics instrument for neurotechnology in November 2025, and the EU already reaches neural data through GDPR special-category treatment and the AI Act. AxiSentinel tracks all of it.
In force since August 7, 2024. Amends Colorado's Privacy Act to classify neural data as sensitive data requiring opt-in consent.
Extends the CCPA's definition of sensitive personal information to neural data, triggering the CCPA's existing opt-out and minimization obligations.
Effective October 1, 2025. Adds "neurotechnology data" to Montana’s genetic privacy act, defines "mental augmentation," and adds a warrant requirement for law enforcement access to neural data.
Effective July 1, 2026. Classifies neural data as sensitive personal data under Connecticut’s consumer data privacy law, making Connecticut the fourth US state with neural-data privacy protections in force, ahead of Vermont on January 1, 2028.
A proposed sector-specific neural-data restriction, stalled in Senate Assignments since 22 May 2026: would bar insurers and employers from using neural data in coverage or employment decisions.
Signed and effective May 18, 2026. Establishes neurological rights principles and mandates a state agency study of neurotechnology in health and human services.
Published October 2021. The first country in the world to give brain activity and the information derived from it constitutional protection.
Adopted November 5, 2025 at the 43rd General Conference. The first global standard-setting instrument on neurotechnology ethics, addressed to member states.
Neural data is not named in the GDPR text, but the European Data Protection Supervisor’s TechDispatch 1/2024 on neurodata confirms it will frequently qualify as a special category of personal data under Article 9. Separately, AI Act Article 5(1)(f) has prohibited inferring emotions from biometric data in workplaces and educational institutions since February 2, 2025.
General-purpose AI risk-management frameworks that already apply to any AI model processing neural or brain-signal data.
Also monitored, not yet enacted: Brazil (a federal neurorights constitutional amendment pending; Rio Grande do Sul’s own state constitutional amendment has been in force since December 20, 2023), Mexico, Argentina, Uruguay, Colombia, and Ecuador (neurorights initiatives introduced, none enacted), and China (a brain-computer interface research-ethics guideline issued February 2024, not a neural-data privacy statute).
From a single wearable device to a fleet of clinical neurotechnology platforms, AxiSentinel evaluates the software and data-handling evidence continuously, not just at launch.
Neurotechnology makers and clinics use AI to interpret neural signals and recommend actions. New neural data laws treat this information as especially sensitive, so every decision that uses it needs a clear basis.
Neural data is among the most personal data there is, and devices that read it must be secure by design. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel's core architecture changes for neurotechnology. What changes is which RegDef packages are switched on and what telemetry the agents capture from a device or platform.
Agents capture device and data-handling telemetry on the cadence you configure, Always On or scheduled, in full rather than sampled, and never limited to a quarterly cycle.
Every telemetry event evaluated against the applicable state's neural-data rule set, per data event.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, verifiable from the first event.
A compliance state change on one device or an entire product line propagates network-wide as it happens.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it.
AxiSentinel can run directly on wearable and edge neurotechnology hardware, including offline or intermittently-connected devices.
Tracks human involvement in consent, retention, and deletion decisions, feeding into AxiSentinel's oversight-gap scoring model.
The same agents generating compliance evidence watch for unauthorized neural-data exfiltration, unconsented model retraining, and scope creep beyond a device's disclosed function before a re-tested release reaches production.
New state law, jurisdiction, or sector-specific rule is added by encoding new RegDef packages. Deployed agents are never rebuilt.
Scoped to your organization during onboarding, not hard-coded into the platform.
A threshold breach becomes a flagged, timestamped, evidence-linked Provisional Alert, reviewed by a qualified AxiLayer AI auditor before anything counts as a finding.
The same architecture monitoring a neurotechnology device monitors a trading desk's model or a hospital's diagnostic AI. What changes is which RegDef packages are switched on.
Whether it's a single wearable device or a fleet of clinical neurotechnology platforms, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
Twenty-seven states, the District of Columbia and Puerto Rico have adopted the NAIC's Model Bulletin on insurers' use of AI, requiring a written AI governance program, documented testing, bias assessment, and consumer notice before an algorithm touches underwriting or claims. AxiSentinel evaluates insurance AI against whichever state's adopted version actually applies.
The NAIC adopted its Model Bulletin on the Use of Artificial Intelligence Systems by Insurers in December 2023. It isn't self-executing, each state's insurance commissioner has to adopt it before it binds insurers licensed there. Twenty-seven states, DC and Puerto Rico have adopted it as of October 2026.
A bias-testing report is a point-in-time exhibit for one regulator. AxiSentinel is built for what happens between filings: continuous evidence that an underwriting or claims model still behaves the way its last test said it would.
Adoption is state-by-state, not federal. AxiSentinel tracks the growing list the same way it tracks every other state-law patchwork.
In force since February 1, 2024, the first state to bind insurers to the NAIC's governance, testing, and documentation requirements.
One of the largest insurance markets to adopt the Bulletin, in force since March 13, 2024.
Adopted December 9, 2024 and March 18, 2025 respectively, extending Bulletin coverage into two more major markets.
27 states, DC and Puerto Rico have adopted the Bulletin as of October 2026, each through its own insurance department bulletin or regulation.
A federal push to preempt state AI law has not invalidated any state insurance bulletin as of this writing; the Bulletin's state-by-state adoption model remains the operative rule.
Classifies AI used for risk assessment and pricing in life and health insurance as high-risk (property/casualty insurance is not covered). Compliance deadline for standalone Annex III systems was pushed from 2 August 2026 to 2 December 2027 under the EU's AI Omnibus simplification package.
Finalized 11 September 2025 by the Office of the Superintendent of Financial Institutions. Explicitly covers federally regulated life and P&C insurers, extending model-risk governance to AI/ML systems and third-party vendor models.
General-purpose AI risk-management frameworks that already apply to any underwriting or claims model an insurer deploys.
From a single underwriting model to a national book of business, AxiSentinel evaluates the software and evidence continuously, not just at filing time.
Insurers use AI to support underwriting, pricing and claims decisions. Insurance regulators in many states now expect a written AI program, testing for unfair discrimination and oversight of the models that affect customers.
In 2026, financial supervisors moved from general AI principles to specific cybersecurity expectations for AI. These are the signals to plan for, as of 28 October 2026.
Explore AI Agent Security Request a Discovery and Risk Assessment
Nothing about AxiSentinel's core architecture changes for insurance. What changes is which RegDef packages are switched on and what telemetry the agents capture from an underwriting or claims system.
Agents capture underwriting and claims-model telemetry on the cadence you configure, Always On or scheduled, in full rather than sampled, and never limited to a quarterly cycle.
Every telemetry event evaluated against the applicable state's adopted bulletin text, per decision.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, verifiable from the first event.
A compliance state change on one model or an entire book of business propagates network-wide as it happens.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it.
AxiSentinel can run across underwriting, claims, and fraud-detection systems, with an offline option for carriers running fully on-prem policy systems.
Tracks human involvement in underwriting and claims decisions, feeding into AxiSentinel's oversight-gap scoring model.
The same agents generating compliance evidence watch for adversarial manipulation of pricing inputs, unauthorized model retraining, and undisclosed proxy variables before a re-tested release reaches production.
New state bulletin adoption, rule, or jurisdiction is added by encoding new RegDef packages. Deployed agents are never rebuilt.
Scoped to your organization during onboarding, not hard-coded into the platform.
A threshold breach becomes a flagged, timestamped, evidence-linked Provisional Alert, reviewed by a qualified AxiLayer AI auditor before anything counts as a finding.
The same architecture monitoring an underwriting model monitors a trading desk's model or a hospital's diagnostic AI. What changes is which RegDef packages are switched on.
Whether it's a single underwriting model or a national book of business across 24 adopting states, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
AI data centers are straining the US grid hard enough that on 18 June 2026 FERC ordered all six major grid operators to justify or reform their large-load interconnection rules, with responses now due by 16 November 2026. AxiSentinel evaluates whether an AI operator's own infrastructure claims, and the grid operators accommodating them, hold up under continuous evidence.
Data centers built for AI training and inference are requesting grid connections at a scale and speed the existing interconnection process was never built for. The federal response arrived as a rulemaking, not a law: FERC ordering the grid operators themselves to rewrite the rules, market by market.
An interconnection study happens once, at application. AxiSentinel is built for what happens after: continuous evidence that a large load's actual grid impact matches what its interconnection filing claimed.
From PJM to the Southwest Power Pool, AxiSentinel tracks the interconnection reforms bearing down on every AI data center's power supply.
FERC's Advance Notice of Proposed Rulemaking covering how large loads, including AI data centers, connect to the transmission grid nationwide. FERC met its self-imposed June 2026 deadline not with a proposed rule but with six tailored Section 206 "show cause" orders, one per RTO/ISO, see the adjacent card.
The largest US grid operator, ordered December 18, 2025 to implement transparent rules for loads co-located with generation resources, with compliance filings due Jan 20 and Feb 16, 2026.
FERC accepted SPP's HILL tariff revisions January 14, 2026, establishing a combined 90-day study-and-approval process for large loads paired with generation.
FERC ordered PJM, MISO, SPP, CAISO, ISO-NE, and NYISO to justify or reform their large-load tariffs, originally within 60 days; after an abeyance, responses are now due 16 Nov 2026 (SPP 20 Nov), covering application processes, cost transparency, co-location, and flexible-load service.
The Secretary of Energy directed FERC to initiate rulemaking specifically to expedite data-center and large-load interconnection.
The Commission for Regulation of Utilities published a binding connection policy requiring new data centers to provide on-site or nearby generation/storage matching peak import demand and to source at least 80% of annual electricity from new-build renewable generation.
General-purpose AI risk-management frameworks that already apply to any AI system whose infrastructure footprint is part of its own risk profile.
From a single data center interconnection to a national portfolio of AI infrastructure, AxiSentinel evaluates the evidence on the cadence you configure, not just at filing time.
Utilities and grid operators use AI to support load forecasts, interconnection studies and investment plans. Decisions that shape reliability for years need a rationale that regulators and boards can follow.
Grid operators use AI for forecasting, balancing and maintenance, which makes its integrity a reliability issue. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel's core architecture changes for energy infrastructure. What changes is which RegDef packages are switched on and what telemetry the agents capture from a large load or grid operator.
Agents capture interconnection and load telemetry on the cadence you configure, Always On or scheduled, in full rather than sampled, and never limited to a quarterly cycle.
Every telemetry event evaluated against the applicable grid operator's tariff rules, per interconnection.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, verifiable from the first event.
A compliance state change on one facility or an entire infrastructure portfolio propagates network-wide as it happens.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it.
AxiSentinel integrates with utility and grid-operator telemetry feeds, with an offline option for facilities with restricted network access.
Tracks human involvement in interconnection and curtailment decisions, feeding into AxiSentinel's oversight-gap scoring model.
The same agents generating compliance evidence watch for misreported load data, unauthorized curtailment bypass, and interconnection-filing drift before a re-tested release reaches production.
New tariff rule, grid operator, or jurisdiction is added by encoding new RegDef packages. Deployed agents are never rebuilt.
Scoped to your organization during onboarding, not hard-coded into the platform.
A threshold breach becomes a flagged, timestamped, evidence-linked Provisional Alert, reviewed by a qualified AxiLayer AI auditor before anything counts as a finding.
The same architecture monitoring a grid interconnection monitors a trading desk's model or a hospital's diagnostic AI. What changes is which RegDef packages are switched on.
Whether it's a single data center interconnection or a national portfolio of AI infrastructure, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
States enacted 55 data center bills in 2026, up from 29 in 2025, and New York's Executive Order 62 of 14 July 2026 became the first statewide pause on permits for large sites. AxiSentinel evaluates whether a data center's siting, rate, water, and incentive claims hold up against whichever jurisdiction's rules actually apply.
The federal story is about grid interconnection: FERC ordering grid operators to rewrite their tariffs. The state and municipal story is a different rulebook entirely, covering siting, cost allocation, water use, tax incentives, and, in a growing number of cities and counties, whether a data center gets approved to break ground at all. Both stories move fast, on different calendars, decided by different bodies.
A siting approval or a tax-incentive agreement is a snapshot at signing. AxiSentinel is built for what happens after: continuous evidence that a data center's actual water use, hiring commitments, and grid draw match what its application promised.
From a White House executive order to Dublin's grid operator, Singapore's competitive allocation board, and Chile's environmental courts, AxiSentinel tracks the worldwide patchwork of data center rules bearing down on siting, rate design, water use, incentives, and community approval.
Directs federal agencies to fast-track NEPA environmental review and identify federal, brownfield, and Superfund sites suitable for AI data center development. EPA guidance implementing the order was issued January 2026.
At least 18 states have introduced or enacted bills creating a dedicated utility rate class or cost-allocation rule for large data center loads, including Texas SB 6 (75+ MW threshold, financial assurance requirements), Oregon's POWER Act (20+ MW, mandatory power purchase agreements), and California SB 886 (25+ MW, onsite storage requirement). South Carolina and Maryland enacted their own rate-negotiation laws in 2025.
New York’s Executive Order 62 (14 Jul 2026) pauses state permits for data centers of 50 MW and above until a generic environmental review is complete; Oklahoma has a proposed pause on facilities above 100 MW through 2029; Vermont’s bill was vetoed on 28 May 2026; moratorium bills were introduced in at least 11 states in 2026.
Minnesota created separate water-permitting requirements for data centers in 2025; Illinois's proposed POWER Act would require water-usage transparency and cumulative environmental impact review near disadvantaged communities for facilities above 50 MW.
Georgia, Oklahoma, Indiana, and Virginia are actively rolling back or restructuring the tax incentives they previously used to attract data center investment.
A growing number of cities and counties are issuing requests for proposals for consulting on data center and large-load development regulatory frameworks, treating siting, utility funding, and public engagement as a distinct scope from federal grid-interconnection rulemaking.
The UK government elevated data centers to the same protection and planning-priority tier as energy and water. A 2025 government policy paper builds on the designation with new sustainability and resilience planning expectations for new facilities.
Operators of data centers above 500kW must report annual energy performance, including PUE, water usage, waste-heat recovery, and renewable energy share, into a European database.
Ireland's multi-year moratorium on new Dublin-area data center grid connections ended December 2025, replaced by a Large Energy User connection policy that gates new connections on demonstrated project credibility and a minimum share of renewable generation.
The UAE and Saudi Arabia are pursuing large sovereign AI data center buildouts under acute water-scarcity constraints, driving a shift toward air-cooled and water-smart design as an emerging expectation, still largely voluntary rather than binding regulation.
Singapore's IMDA allocates new data center capacity through a competitive, sustainability-gated process (PUE at or below 1.3, 100% renewable energy certificates, majority liquid cooling), while Australia's federal government has signalled a move toward nationally consistent rules requiring facilities to be net clean-energy generators. India's state governments compete in the opposite direction, offering capital subsidies and stamp-duty exemptions to attract data center investment.
Chile's environmental courts have directly blocked or reset data center permits over aquifer and drought concerns, most visibly a major Santiago-area project paused in September 2024 and sent back through the approval process from scratch. Community opposition citing water scarcity is a recurring feature of new proposals across the region.
Community opposition to data center siting is generating a growing body of litigation and public hearings over water use, noise, and land use, adding a layer of approval risk beyond the regulatory text itself.
General-purpose AI risk-management frameworks that already apply to any AI system whose infrastructure footprint, including its physical siting and environmental impact, is part of its own risk profile.
From a single municipal siting review to a nationwide portfolio of large-load facilities, AxiSentinel evaluates the evidence on the cadence you configure, not just at the permitting or incentive-agreement stage.
Developers and operators use AI to compare sites, power options and cooling designs for large-load projects. Each decision faces utilities, regulators, communities and investors who will ask how it was made.
Data centers now host the most valuable AI assets there are: model weights, training data and the compute behind them. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel's core architecture changes for data center and large-load development. What changes is which RegDef packages are switched on, covering the state, municipal, and federal rules that apply to a given site.
Agents capture siting, water-use, and load telemetry on the cadence you configure, Always On or scheduled, in full rather than sampled, and never limited to a quarterly cycle.
Every telemetry event evaluated against the applicable state, municipal, or federal rule, per facility.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, verifiable from the first event.
A compliance state change on one facility or an entire portfolio propagates network-wide as it happens.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it.
AxiSentinel integrates with utility, permitting, and municipal telemetry feeds, with an offline option for facilities with restricted network access.
Tracks human involvement in siting, incentive, and community-commitment decisions, feeding into AxiSentinel's oversight-gap scoring model.
The same agents generating compliance evidence watch for misreported water or hiring data and permit-filing drift before a re-tested release reaches production.
A new state, municipality, or jurisdiction is added by encoding new RegDef packages. Deployed agents are never rebuilt.
Scoped to your organization during onboarding, not hard-coded into the platform.
A threshold breach becomes a flagged, timestamped, evidence-linked Provisional Alert, reviewed by a qualified AxiLayer AI auditor before anything counts as a finding.
The same architecture monitoring a data center siting review monitors a trading desk's model or a hospital's diagnostic AI. What changes is which RegDef packages are switched on.
Whether it's a single municipal siting review or a nationwide portfolio of large-load facilities, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
The federal TAKE IT DOWN Act, signed May 19, 2025, gave platforms until May 19, 2026 to build a working notice-and-removal process for AI-generated intimate imagery, and the FTC began enforcing it that same month. AxiSentinel is built to evaluate whether a platform's actual takedown, detection, and disclosure practices match what the law, and the growing set of international rules layered on top of it, require.
States moved first on deepfakes: political-ad disclaimers, non-consensual intimate imagery, and CSAM-adjacent statutes in nearly every legislature. The federal government moved second, but its rule bites hardest: a 48-hour takedown clock, enforced by the FTC, that reaches any platform hosting user-generated content.
A takedown log is a record of what already happened. AxiSentinel is built for the 48-hour clock itself: continuous evidence that a valid request was actually honored in time, every time.
Eight non-US regimes are already in force, four of them since this year alone. From the federal takedown clock to state-by-state disclosure rules to the international layer, AxiSentinel tracks the full stack of obligations bearing down on platforms and AI content tools.
Requires covered platforms to remove nonconsensual intimate images and AI-generated "digital forgeries" within 48 hours of a valid request.
The FTC began enforcing Section 3 in May 2026, operating TakeItDown.ftc.gov and directly warning major platforms of their compliance obligations.
Multiple states require clear disclaimers when political advertising contains digitally manipulated imagery.
AB 2839 was preliminarily enjoined and AB 2655 was struck down; a federal court found parts of California's deepfake framework unconstitutionally broad and content-discriminatory, narrowing what the state can actually enforce.
Every state has introduced legislation addressing non-consensual sexual deepfakes and AI-generated child sexual abuse material.
Measures published March 14, 2025 by the Cyberspace Administration of China with three further ministries. Mandatory national standard GB 45438-2025 published February 28, 2025. Both effective September 1, 2025.
Article 50 transparency obligations have applied since August 2, 2026. The AI Omnibus, Regulation (EU) 2026/1744, entered into force July 27, 2026.
Effective January 2026. Requires advance notice that a product or service uses AI, labeling of generative AI output, and clear indication of realistic synthetic content, with a narrow exemption for artistic works.
General-purpose AI risk-management frameworks that already apply to any generative-AI tool capable of producing synthetic media.
From a single takedown request to a platform's entire content-moderation pipeline, AxiSentinel evaluates the evidence on the cadence you configure, not just after the fact.
Platforms, studios and AI tool makers use AI to decide what is generated, labeled, ranked or removed. EU AI Act labeling duties and new laws on deepfakes and non-consensual imagery make each of those decisions one that may need explaining.
Generated video, voice and images are now good enough to impersonate anyone, which makes provenance a security control. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel's core architecture changes for content platforms. What changes is which RegDef packages are switched on and what telemetry the agents capture from a moderation or generation pipeline.
Agents capture takedown-request and content-moderation telemetry on the cadence you configure, Always On or scheduled, in full rather than sampled, and never limited to a quarterly cycle.
Every telemetry event evaluated against the applicable federal or state rule, per request.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, verifiable from the first event.
A compliance state change on one takedown queue or an entire platform propagates network-wide as it happens.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it.
AxiSentinel can run across content-moderation pipelines and generative-AI APIs, including high-volume, low-latency environments.
Tracks human involvement in takedown and appeal decisions, feeding into AxiSentinel's oversight-gap scoring model.
The same agents generating compliance evidence watch for coordinated deepfake-distribution campaigns, takedown-evasion patterns, and unauthorized re-uploads before a re-tested release reaches production.
New federal rule, state law, or jurisdiction is added by encoding new RegDef packages. Deployed agents are never rebuilt.
Scoped to your organization during onboarding, not hard-coded into the platform.
A threshold breach becomes a flagged, timestamped, evidence-linked Provisional Alert, reviewed by a qualified AxiLayer AI auditor before anything counts as a finding.
The same architecture monitoring a content-moderation pipeline monitors a trading desk's model or a hospital's diagnostic AI. What changes is which RegDef packages are switched on.
Whether it's a single takedown request or a platform's entire content-moderation pipeline, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
At least twelve states have enacted companion-chatbot laws, each requiring AI-disclosure reminders, a working suicide and self-harm crisis-referral protocol, and limits on content served to minors, and California's SB 1119, signed on 10 September 2026, adds risk assessments, parental controls and third-party audits for large operators from 2029. AxiSentinel evaluates a companion AI product against whichever state's law its users are actually sitting in.
No state had a companion-chatbot-specific law before 2025. California and New York moved first; ten more states followed within months, each with its own disclosure cadence and enforcement mechanism. A twelfth is awaiting a governor's signature.
A published safety policy is a static document. AxiSentinel is built for what happens in the conversation: continuous evidence that a companion product's crisis-referral protocol actually fires when it should, not just that one exists on paper.
Enactment is state-by-state in the US, and the single most demanding companion-AI rule in force anywhere in the world is not American at all. AxiSentinel tracks the growing list, state and international, the same way it tracks every other patchwork.
The first companion-chatbot statute nationwide, with a private right of action carrying damages of at least $1,000 per violation. Three distinct dates: signed October 13, 2025; core duties operative January 1, 2026; annual reporting begins July 1, 2027.
In force since November 5, 2025; the Attorney General can seek civil penalties up to $15,000 per day, directed to a suicide-prevention fund.
Each enacted its own companion-chatbot statute in the first half of 2026, most taking effect on 1 Jan or 1 Jul 2027, sharing the same disclosure and crisis-protocol core with different penalty structures.
Rounds out the current group of twelve states with an enacted companion-chatbot law as of mid-2026.
Signed July 14, 2026, rounding out the current group of twelve enacted states. Persistent and session-start disclosure, hourly for minors.
Passed the legislature but was vetoed by the governor. Not law, and not part of the twelve-state enacted count, listed here only so a reader can see what did not survive.
Introduced October 28, 2025 by Sen. Hawley with Blumenthal, Britt and Murphy; cleared the Senate Judiciary Committee unanimously on April 30, 2026 but no floor vote has been scheduled in either chamber.
Orders issued around September 11, 2025 to seven companies, including Alphabet, Character Technologies, Instagram, Meta, OpenAI, Snap and xAI. An open information-gathering inquiry: no report, complaint, or consent order as of today. Not an enforcement action.
Issued by the Cyberspace Administration of China with four further agencies around April 10, 2026, effective July 15, 2026. The most prescriptive companion-AI rule in force anywhere.
Registered September 9, 2025, enforceable from March 9, 2026. Explicitly names AI companion chatbots and AI companion chatbot features.
Articles 5(1)(a) and 5(1)(b) have applied since February 2, 2025 and prohibit manipulative techniques and the exploitation of vulnerabilities including age. Article 50(1) has applied since August 2, 2026 and requires disclosure that a person is interacting with an AI system.
The Italian data protection authority blocked Replika’s processing of Italian users’ data on February 2, 2023 and fined its maker, Luka Inc., five million euro in 2025 for lack of a lawful basis and absence of age verification. Italy’s national AI law, Law 132/2025, in force from around October 2025, sets a minimum age of 14 for a minor’s consent to AI use.
Eight states restrict AI systems that hold themselves out as therapy or mental-health treatment, a narrower duty than general companion-chatbot disclosure and a different buyer conversation. Keeping the two categories separate is what keeps the twelve-state companion count accurate: Illinois HB 1806 (in force August 4, 2025), Nevada AB 406 (in force June 29, 2025), Utah HB 452 (in force May 7, 2025), Tennessee SB 1580 (signed April 1, 2026, effective July 1, 2026), Maine LD 2082 (signed April 13, 2026, effective July 29, 2026), Colorado HB 1195 (signed June 3, 2026, effective August 12, 2026), Vermont H 816 / Act 156 (June 17, 2026), and Rhode Island H 7349 / S 2197 (June 22, 2026).
From a single companion app to a portfolio of conversational AI surfaces, AxiSentinel evaluates the software and evidence continuously, not just at policy-publication time.
Companion chatbots make constant decisions: when to remind a user it is AI, when to escalate a crisis, and what a minor may see. Companion chatbot laws in several U.S. states now expect those decisions to follow written protocols.
Companion apps hold intimate conversations, often with vulnerable users, so a breach or jailbreak causes real harm. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel's core architecture changes for companion AI. What changes is which RegDef packages are switched on and what telemetry the agents capture.
Agents capture conversation-safety telemetry on the cadence you configure, Always On or scheduled, in full rather than sampled, and never limited to a quarterly cycle.
Every telemetry event evaluated against the applicable state's disclosure and crisis-protocol requirements, per conversation turn.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, verifiable from the first event.
A compliance state change on one companion product or an entire chatbot portfolio propagates network-wide as it happens.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it.
AxiSentinel can run across companion, character, and general-purpose chatbot surfaces, including products with restricted API access.
Tracks human involvement in crisis-escalation and content-moderation decisions, feeding into AxiSentinel's oversight-gap scoring model.
The same agents generating compliance evidence watch for jailbreak attempts against safety guardrails, disclosure-suppression prompts, and undisclosed model swaps before a re-tested release reaches production.
New rule, jurisdiction, or requirement is added by encoding new RegDef packages. Deployed agents are never rebuilt.
Scoped to your organization during onboarding, not hard-coded into the platform.
A threshold breach becomes a flagged, timestamped, evidence-linked Provisional Alert, reviewed by a qualified AxiLayer AI auditor before anything counts as a finding.
The same architecture monitoring this industry's AI monitors a trading desk's model or a hospital's diagnostic AI. What changes is which RegDef packages are switched on.
Whether it's a single companion product or a portfolio of conversational AI surfaces across twelve enacted states, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
What began as a single New York City hiring-tool ordinance is now a multi-state compliance regime: Illinois requires notice, California requires four-year recordkeeping and treats anti-bias testing as evidence, Connecticut's CART Act took effect on 1 October 2026, Colorado's replacement law applies from 1 January 2027, and California's No Robo Bosses Act follows on 1 July 2027. AxiSentinel evaluates employment AI against whichever jurisdiction's rule actually applies to a given hire.
NYC's Local Law 144 was the first hiring-AI ordinance in the country when it took effect in 2023. It is no longer the only rule that matters: Illinois, California, Colorado, and now Connecticut have each added binding obligations of their own, a December 2025 government audit found NYC's own enforcement of the original law is not working as designed, and Illinois itself has since paused its own implementing rules while the underlying statute stays in force.
An annual bias audit is a once-a-year snapshot. AxiSentinel is built for what happens the other 364 days: continuous evidence that a hiring or promotion model still tests the way its last audit said it would.
Coverage is jurisdiction-by-jurisdiction, not federal. AxiSentinel tracks the growing list the same way it tracks every other multi-jurisdiction patchwork.
In force since July 5, 2023; requires an annual bias audit and candidate notice before an automated employment decision tool is used.
In force since October 1, 2025; requires four-year record retention and reasonable accommodation processes for ADS tools, and makes anti-bias testing relevant evidence.
In force since January 1, 2026; AI with the effect of discriminating in employment decisions is a civil rights violation, with mandatory employee notice.
Signed May 14, 2026 after a federal court blocked the original AI Act; takes effect January 1, 2027 with a narrower, notice-based approach.
Signed June 2, 2026, adding Connecticut as the fifth US jurisdiction with binding employment-AI obligations, including notice when AI is used in hiring and employment decisions.
No federal employment-AI statute is in force; existing Title VII disparate-impact theory already applies to hiring algorithms regardless of state law.
In force since January 1, 2026; employers with 25 or more employees must disclose in publicly advertised job postings whether AI is used to screen, assess, or select applicants.
General-purpose AI risk-management frameworks that already apply to any hiring, promotion, or termination model an employer deploys.
From a single hiring model to a national talent-acquisition stack, AxiSentinel evaluates the software and evidence continuously, not just at annual-audit time.
Employers use AI to screen, rank and promote people. Hiring laws in several U.S. states and cities, and the EU AI Act, treat these as high-stakes decisions that need fairness testing, notice and human review.
Hiring AI reads documents from strangers, which makes it an easy target for hidden instructions and data theft. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel's core architecture changes for employment AI. What changes is which RegDef packages are switched on and what telemetry the agents capture.
Agents capture hiring, promotion, and termination-model telemetry on the cadence you configure, Always On or scheduled, in full rather than sampled, and never limited to an annual audit cycle.
Every telemetry event evaluated against the applicable jurisdiction's notice and testing requirements, per decision.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, verifiable from the first event.
A compliance state change on one hiring model or an entire talent-acquisition stack propagates network-wide as it happens.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it.
AxiSentinel can run across applicant-tracking, video-interview, and skills-assessment systems, with an offline option for employers running fully on-prem HR systems.
Tracks human involvement in hiring, promotion, and termination decisions, feeding into AxiSentinel's oversight-gap scoring model.
The same agents generating compliance evidence watch for adversarial resume manipulation, unauthorized model retraining, and undisclosed proxy variables before a re-tested release reaches production.
New rule, jurisdiction, or requirement is added by encoding new RegDef packages. Deployed agents are never rebuilt.
Scoped to your organization during onboarding, not hard-coded into the platform.
A threshold breach becomes a flagged, timestamped, evidence-linked Provisional Alert, reviewed by a qualified AxiLayer AI auditor before anything counts as a finding.
The same architecture monitoring this industry's AI monitors a trading desk's model or a hospital's diagnostic AI. What changes is which RegDef packages are switched on.
Whether it's a single hiring model or a national talent-acquisition stack spanning New York City, California, Illinois, and Colorado, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
Maryland and Connecticut surveillance-pricing bans took effect on 1 October 2026, New York requires an on-screen disclosure when an algorithm sets a price using personal data, and four states now restrict algorithmic rent-setting software. AxiSentinel evaluates whether a pricing algorithm used only the data it was allowed to use, and whether the required disclosure actually appears.
What started as an antitrust case against one rent-pricing vendor has become three parallel regulatory tracks: cities banning or restricting algorithmic rent-setting software, states now banning it outright statewide, and states requiring disclosure when a consumer price was personalized using their own data. All three are moving fast, and none is federal yet.
A pricing algorithm's terms of service say what data it is allowed to use. AxiSentinel is built for the harder question: whether it actually used only that data, on the day it set that price.
Coverage is city-by-city and state-by-state, not federal. AxiSentinel tracks the growing list the same way it tracks every other multi-jurisdiction patchwork.
Requires the specific disclosure “This price was set by an algorithm using your personal data” whenever personalized algorithmic pricing is used; penalties up to $1,000 per violation.
San Francisco, Philadelphia, Seattle, King County, Berkeley, Minneapolis, Spokane, Portland, Santa Ana, San Diego, Providence, Jersey City, Hoboken, and Rockville, MD (from 1 Jan 2027) each restrict rent-setting software using nonpublic competitor data, enacted between late 2024 and mid-2026.
In force since January 1, 2026; a statewide (not city-level) ban on using a revenue-management device to set residential rental rates or occupancy levels.
Signed July 20, 2026; the fourth state to bar algorithmic rent-coordination statewide, effective July 1, 2027.
Attorney General Bonta opened a January 27, 2026 sweep of retail, grocery, and hotel pricing; AB 2564, which would have barred surveillance pricing outright, died on 31 Aug 2026 at the final concurrence vote.
The FTC opened surveillance-pricing inquiries in 2024 and published findings in 2025; the House Oversight Committee opened a parallel inquiry into travel and hospitality pricing on March 5, 2026.
The federal DOJ case against RealPage has resolved defendant-by-defendant through consent decrees rather than trial (Greystar's final judgment entered March 2, 2026, following a $7M nine-state settlement; Willow Bridge's proposed judgment filed July 6, 2026; Pinnacle's proposed judgment filed September 4, 2026), and those settlements have spawned a wave of new private suits, including Gomez v. Greystar and Keller v. UDR, built directly on the municipal restrictions above.
General consumer-protection law already reaches deceptive or unfair pricing practices regardless of whether a jurisdiction has passed an algorithm-specific statute.
From a single pricing model to a national retail, hospitality, or property-management portfolio, AxiSentinel evaluates the software and evidence continuously, not just at filing time.
Retailers, landlords and service providers use AI to set and change prices. New rules, such as New York's algorithmic pricing disclosure law, require disclosure when personal data sets a price, and regulators are watching for unfair outcomes.
Pricing models run on live market and customer data, which competitors and fraudsters both try to manipulate or copy. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel's core architecture changes for pricing AI. What changes is which RegDef packages are switched on and what telemetry the agents capture.
Agents capture pricing-input and pricing-output telemetry on the cadence you configure, Always On or scheduled, in full rather than sampled, and never limited to a quarterly cycle.
Every telemetry event evaluated against the applicable city or state's disclosure and data-use rules, per pricing decision.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, verifiable from the first event.
A compliance state change on one pricing algorithm or an entire portfolio propagates network-wide as it happens.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it.
AxiSentinel can run across retail, hospitality, and property-management pricing systems, with an offline option for operators with restricted network access.
Tracks human involvement in pricing-override and exception decisions, feeding into AxiSentinel's oversight-gap scoring model.
The same agents generating compliance evidence watch for unauthorized data-source additions, undisclosed model retraining, and coordinated-pricing signal drift before a re-tested release reaches production.
New rule, jurisdiction, or requirement is added by encoding new RegDef packages. Deployed agents are never rebuilt.
Scoped to your organization during onboarding, not hard-coded into the platform.
A threshold breach becomes a flagged, timestamped, evidence-linked Provisional Alert, reviewed by a qualified AxiLayer AI auditor before anything counts as a finding.
The same architecture monitoring this industry's AI monitors a trading desk's model or a hospital's diagnostic AI. What changes is which RegDef packages are switched on.
Whether it's a single dynamic-pricing model or a national portfolio spanning retail, hospitality, and rental markets, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
States enacted 13 AI-in-education laws in 2026, Ohio now requires every district to have a binding AI-use policy, and Idaho, Maryland, Oklahoma and Virginia have joined Tennessee in writing AI rules for schools into statute. AxiSentinel evaluates a district or institution's AI use against whichever rule, mandatory or advisory, actually applies to it.
Tennessee required district AI policies in 2024, Ohio set a statutory deadline of 1 July 2026, and Idaho signed its own statute in 2026, part of 13 AI-in-education laws enacted this year in a field still largely made of guidance documents, model policies, and bills stuck in committee.
A district AI policy is a document. AxiSentinel is built for the harder question: whether the tools actually deployed in classrooms match what that policy says is allowed.
Coverage ranges from binding statute to purely advisory guidance, and the difference matters. AxiSentinel tracks which is which, jurisdiction by jurisdiction.
Signed March 26, 2026; directs the state education department to build a statewide generative-AI framework, with districts required to adopt aligned local policies.
In force since September 30, 2025; requires every district, community school, and STEM school to adopt a local AI-use policy by July 1, 2026.
California's CDE model policy (July 6, 2026) is explicitly voluntary under Education Code §33308.5; North Carolina's HB 301 passed both chambers in different forms and sits in conference committee, not yet law; the US Department of Education's April 13, 2026 Federal Register priority shapes discretionary-grant scoring, not a classroom mandate.
Classifies four education use cases as high-risk: admission/access systems, evaluation of learning outcomes, assessing the appropriate level of education for an individual, and monitoring or detecting prohibited student behavior during tests (proctoring).
The UK Department for Education's generative-AI guidance (updated June 10, 2025) and companion support materials are explicitly non-statutory. China's Ministry of Education issued a similar guideline for primary and secondary schools (May 16, 2025), and Australia's national Generative AI in Schools framework is opt-in for states and territories.
General-purpose AI risk-management frameworks that already apply to any instructional, assessment, or proctoring model a district or institution deploys.
From a single district's AI-use policy to a multi-campus higher-education deployment, AxiSentinel evaluates the software and evidence continuously, not just at policy-adoption time.
Schools and universities use AI to support admissions, placement, grading and resource decisions. Decisions that shape a student's path need a rationale that families and regulators can follow.
Schools and edtech hold children’s data and run AI tutors used by millions, which raises the stakes of every security gap. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel's core architecture changes for education AI. What changes is which RegDef packages are switched on and what telemetry the agents capture.
Agents capture instructional, assessment, and proctoring-model telemetry on the cadence you configure, Always On or scheduled, in full rather than sampled, and never limited to policy-adoption time.
Every telemetry event evaluated against the applicable district, state, or national policy's requirements, per decision.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, verifiable from the first event.
A compliance state change on one instructional tool or an entire campus deployment propagates network-wide as it happens.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it.
AxiSentinel can run across instructional, assessment, proctoring, and admissions systems, with an offline option for districts running fully on-prem ed-tech systems.
Tracks human involvement in grading, admissions, and academic-integrity decisions, feeding into AxiSentinel's oversight-gap scoring model.
The same agents generating compliance evidence watch for adversarial prompt manipulation, unauthorized model retraining, and undisclosed proxy variables before a re-tested release reaches production.
New rule, jurisdiction, or requirement is added by encoding new RegDef packages. Deployed agents are never rebuilt.
Scoped to your organization during onboarding, not hard-coded into the platform.
A threshold breach becomes a flagged, timestamped, evidence-linked Provisional Alert, reviewed by a qualified AxiLayer AI auditor before anything counts as a finding.
The same architecture monitoring this industry's AI monitors a trading desk's model or a hospital's diagnostic AI. What changes is which RegDef packages are switched on.
Whether it's a single district's AI-use policy or a multi-campus higher-education deployment spanning instruction, assessment, and admissions, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
More than 30 states now regulate AI deepfakes in election communications, and since 2 August 2026 Article 50 of the EU AI Act has required deepfake disclosure, layered on the Union’s political-advertising transparency rules in force since October 2025. AxiSentinel evaluates political-advertising AI against whichever rule, state or EU, actually applies to it.
More than 30 states now regulate deceptive political deepfakes, from simple disclosure requirements to categorical bans, within two election cycles, while the EU layered a Union-wide disclosure duty on top of member states’ own election law. Two other states’ laws were struck down for reaching too far without a satire exemption, a reminder that not every enactment survives its first court test.
A disclosure label or an outright ban is a rule on paper. AxiSentinel is built for the harder question: whether the specific ad that actually ran carried the label, metadata tag, or exemption its jurisdiction required, at the moment it aired.
Coverage ranges from a state disclosure statute to a Union-wide transparency regulation, and two enactments that did not survive a First Amendment challenge. AxiSentinel tracks which is which, jurisdiction by jurisdiction.
New Mexico HB 182 (disclosure, eff. May 15, 2024); Colorado Rev. Stat. §1-46-103 and Washington SB 5152 (onscreen label plus embedded metadata tag); Maryland Election Law §16-905, Texas Election Code §255.004, and Mississippi Title 97 Chapter 13 (outright bans on deceptive candidate deepfakes).
Effective August 2, 2026. Deployers must disclose deepfake image, audio and video, including political content, and must disclose AI-generated text on matters of public interest unless it underwent human editorial review with a person assuming editorial responsibility.
Adopted March 13, 2024; most provisions apply from October 10, 2025. Requires sponsor, cost, and targeting-criteria disclosure on political ads, bars targeting on special-category data or near-voting-age minors, and restricts non-EU ad purchases in the final three months before a vote.
Both confirmed struck down on First Amendment grounds for lacking a satire exemption. Neither is part of AxiSentinel’s coverage, and neither should be relied on as current law.
Mississippi SB2050 (2026) passed only the Senate and is not yet law. No federal deepfake-in-elections statute exists; the FEC has not adopted a specific rule. Additional state bills remain in committee.
General-purpose AI risk-management frameworks that already apply to any system generating or targeting political-advertising content, state and EU law aside.
From a single state disclosure label to a Union-wide transparency notice, AxiSentinel evaluates the ad that actually ran, continuously, not just the policy that says what should have run.
Campaigns, platforms and ad networks use AI to decide which political content needs a disclosure, a label or removal. State deepfake laws and EU transparency rules mean each of those calls may be challenged.
AI makes it cheap to impersonate candidates and officials and to target election staff with convincing phishing. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel's core architecture changes for political-advertising AI. What changes is which RegDef packages are switched on and what telemetry the agents capture.
Agents capture political-ad generation, targeting, and placement telemetry on the cadence you configure, Always On or scheduled, in full rather than sampled, and never limited to ad-buy time.
Every telemetry event evaluated against the applicable state disclosure statute, ban law, or EU regulation's requirements, per decision.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, verifiable from the first event.
A compliance state change on one ad, one campaign, or an entire platform’s political-ad pipeline propagates network-wide as it happens.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it.
AxiSentinel can run across ad-generation, targeting, and placement systems, with an offline option for campaigns and platforms running fully on-prem ad-production systems.
Tracks human involvement in ad-approval, targeting, and takedown decisions, feeding into AxiSentinel's oversight-gap scoring model.
The same agents generating compliance evidence watch for adversarial prompt manipulation, unauthorized model retraining, and undisclosed proxy variables before a re-tested release reaches production.
New rule, jurisdiction, or requirement is added by encoding new RegDef packages. Deployed agents are never rebuilt.
Scoped to your organization during onboarding, not hard-coded into the platform.
A threshold breach becomes a flagged, timestamped, evidence-linked Provisional Alert, reviewed by a qualified AxiLayer AI auditor before anything counts as a finding.
The same architecture monitoring this industry's AI monitors a trading desk's model or a hospital's diagnostic AI. What changes is which RegDef packages are switched on.
Whether it’s a single state’s disclosure statute or the EU’s Union-wide transparency regime, AxiSentinel evaluates political-advertising AI the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
New York's courts made verification of AI-assisted filings a binding statewide rule on 1 June 2026, and Florida's Supreme Court followed on 15 June 2026 with a rule that preempts individual circuit courts. Illinois and California bar guidance shapes professional responsibility without binding force, and in September 2026 Quebec's courts restricted judges themselves from outsourcing judicial reasoning to a language model. AxiSentinel evaluates a firm's or court's AI use against whichever rule, binding or advisory, actually governs it.
The pattern is no longer isolated sanctions against individual lawyers who filed fabricated citations. Florida converted the problem into a standing statewide rule, Illinois and California issued profession-wide guidance, and by September 2026 even judges’ own use of AI in the courtroom drew its first restriction, in Quebec.
A firm’s AI-use policy, or a court’s AI guidance, describes what should happen. AxiSentinel is built for the harder question: whether the specific citations, drafts, and filings an AI tool touched were actually verified before they were submitted.
Coverage ranges from Florida’s binding statewide rule to international judicial guidance that carries real professional weight without binding force. AxiSentinel tracks which is which, and never treats guidance as if it were a rule.
Effective June 15, 2026. A statewide administrative order preempts individual circuit courts from imposing their own AI disclosure or certification rules.
Illinois Supreme Court Policy on Artificial Intelligence (announced December 18, 2024) and the California State Bar’s COPRAC Practical Guidance on Generative AI in Legal Practice (2026 revision). Both explicitly advisory, not new binding rules, but both carry real professional-responsibility weight.
Announced September 5, 2026. Guidelines state that AI cannot replace judicial reasoning, the assessment of evidence, or deliberation, and that judges may not outsource the intellectual core of their role to a language model. Research, administration, and drafting support remain permitted.
Victoria Supreme Court Practice Note SC GEN 25 on AI use by court users, and the South Australia Supreme Court’s January 2026 generative-AI guidelines. Both advisory frameworks for litigants and practitioners appearing before those courts.
The Judiciary of England and Wales’ AI guidance and a UNESCO draft framework for the use of AI systems in courts and tribunals both offer reference points for judicial AI use without creating enforceable obligations.
General-purpose AI risk-management frameworks that already apply to any generative-AI tool a firm or court deploys for research, drafting, or review.
From a single fabricated citation to a firm-wide generative-AI deployment, AxiSentinel evaluates the tool and the filing continuously, not just at the point a policy was adopted.
Law firms, legal departments and courts use AI to research, draft and recommend. Professional guidance now expects lawyers to verify AI output and to stand behind every conclusion.
Legal AI handles privileged information, so confidentiality failures are both security incidents and professional ones. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel's core architecture changes for legal-profession AI. What changes is which RegDef packages are switched on and what telemetry the agents capture.
Agents capture legal research, drafting, and citation-generation telemetry on the cadence you configure, Always On or scheduled, in full rather than sampled, and never limited to filing time.
Every telemetry event evaluated against the applicable court rule, bar guidance, or judicial policy's requirements, per decision.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, verifiable from the first event.
A compliance state change on one filing, one matter, or an entire firm’s AI-tool deployment propagates network-wide as it happens.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it.
AxiSentinel can run across research, drafting, review, and e-discovery systems, with an offline option for firms and courts running fully on-prem legal-AI systems.
Tracks human involvement in citation-checking, drafting-review, and filing-approval decisions, feeding into AxiSentinel's oversight-gap scoring model.
The same agents generating compliance evidence watch for adversarial prompt manipulation, unauthorized model retraining, and undisclosed proxy variables before a re-tested release reaches production.
New rule, jurisdiction, or requirement is added by encoding new RegDef packages. Deployed agents are never rebuilt.
Scoped to your organization during onboarding, not hard-coded into the platform.
A threshold breach becomes a flagged, timestamped, evidence-linked Provisional Alert, reviewed by a qualified AxiLayer AI auditor before anything counts as a finding.
The same architecture monitoring this industry's AI monitors a trading desk's model or a hospital's diagnostic AI. What changes is which RegDef packages are switched on.
Whether it’s a single citation an AI research tool produced or a firm-wide generative-AI deployment spanning research, drafting, and review, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
The FCC’s 2024 declaratory ruling confirmed that AI-generated and cloned voices fall under the Telephone Consumer Protection Act’s consent and disclosure rules, China’s AI-content-labeling measures have reached synthetic voice since September 2025, and since 2 August 2026 the EU AI Act has required AI voice agents to disclose that they are AI. AxiSentinel evaluates a caller’s actual consent, opt-out, and disclosure practice against whichever rule applies.
The FCC did not need a new statute to reach AI-generated robocalls; it read the TCPA’s existing “artificial or prerecorded voice” language to already cover them. China took the opposite path and wrote AI-voice labeling directly into a national content rule. Most other jurisdictions still rely on generic anti-spoofing, telemarketing, and consent law that predates generative voice AI, or are still drafting AI-specific rules that have not been enacted.
A TCPA-compliant consent record or a labeled AI call is a policy. AxiSentinel is built for the harder question: whether the call that actually reached a consumer’s phone carried the consent, disclosure, and opt-out the rule required.
Coverage splits into two tracks: jurisdictions with a binding rule written for AI voice specifically, and jurisdictions relying on generic anti-spoofing or consent law that reaches AI-generated calls only incidentally. AxiSentinel tracks which is which, rather than treating a caller-ID rule as if it were an AI-voice statute.
Released and effective February 8, 2024. Confirms the Telephone Consumer Protection Act’s “artificial or prerecorded voice” restriction covers AI-generated and AI-cloned voice technology.
The Deep Synthesis Provisions (effective January 10, 2023) and the Measures for Labeling of AI-Generated Synthetic Content (mandatory, effective September 1, 2025) require explicit or implicit labeling of AI-generated content, including synthetic voice, with platform-level enforcement duties.
Binding caller-ID-authentication requirements, including a January 29, 2025 deadline to block spoofed UK numbers presented from abroad, reach AI-generated calls only as a byproduct of general anti-spoofing and telemarketing consent law. No AI-voice-specific statute was identified.
A review of the Unsolicited Telecommunications Rules, with proposals touching AI voice calling, remained open for public comment as of this writing. Not yet a decided rule.
Issued April 2026, alongside a planned Calling Name Presentation (CNAP) verified caller-ID rollout. Addresses spam and spoofed calls broadly; still in draft, not yet enacted, and not AI-voice-specific.
General-purpose AI risk-management frameworks that already apply to voice-AI systems generating outbound calls, regardless of whether a jurisdiction has an AI-specific voice-call rule yet.
From a single outbound campaign to a carrier’s entire AI-voice traffic, AxiSentinel evaluates the call that actually reached a phone, continuously, not just the consent policy on file.
Carriers and calling platforms use AI to decide which calls to place, label or block. Rules on AI-generated voices in calls make those decisions part of the compliance record.
Cloned voices and AI calling agents make phone scams more convincing and far cheaper to run. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel's core architecture changes for AI-voice telecom systems. What changes is which RegDef packages are switched on and what telemetry the agents capture.
Agents capture outbound AI-voice call generation, consent-matching, and delivery telemetry on the cadence you configure, Always On or scheduled, in full rather than sampled, and never limited to campaign-launch time.
Every telemetry event evaluated against the applicable FCC ruling, China’s labeling measures, or applicable anti-spoofing rule's requirements, per decision.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, verifiable from the first event.
A compliance state change on one call, one campaign, or an entire carrier’s AI-voice traffic propagates network-wide as it happens.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it.
AxiSentinel can run across outbound calling, consent-management, and labeling systems, with an offline option for carriers and contact centers running fully on-prem calling infrastructure.
Tracks human involvement in consent-verification, labeling, and opt-out-handling decisions, feeding into AxiSentinel's oversight-gap scoring model.
The same agents generating compliance evidence watch for adversarial prompt manipulation, unauthorized model retraining, and undisclosed proxy variables before a re-tested release reaches production.
New rule, jurisdiction, or requirement is added by encoding new RegDef packages. Deployed agents are never rebuilt.
Scoped to your organization during onboarding, not hard-coded into the platform.
A threshold breach becomes a flagged, timestamped, evidence-linked Provisional Alert, reviewed by a qualified AxiLayer AI auditor before anything counts as a finding.
The same architecture monitoring this industry's AI monitors a trading desk's model or a hospital's diagnostic AI. What changes is which RegDef packages are switched on.
Whether it’s a single outbound campaign or a carrier’s entire AI-voice traffic, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
AxiSentinel finds and controls AI agents, with continuous compliance evaluation, for civil aviation and aerospace: flight-control assistance, air traffic management, predictive maintenance, airport security, and the drones and electric air taxis now entering certified service, evaluated against the rules of ICAO, EASA, the FAA, the UK CAA, CAAC and every other civil aviation authority whose airspace the aircraft actually flies through. The FAA’s Part 108 rule for beyond-visual-line-of-sight drone operations has been under White House review since 10 July 2026, and EASA published Issue 03 of its AI concept paper on 3 June 2026.
For a century, aviation safety has been proven through exhaustive, one-time certification: a design frozen, tested against a standard, and approved. That model assumes the system does not keep changing after approval. AI breaks that assumption, in the cockpit, in the tower, and now in aircraft that have no cockpit at all.
Every continuous AI-monitoring platform built so far was built for models that run in a data center or, at best, on a factory floor. None of them were built to evaluate an AI system certified to fly, to separate aircraft in controlled airspace, or to decide which bag gets flagged for a second look.
Aviation AI sits under both civil aviation safety law and general AI law, in every jurisdiction an aircraft or a drone operates in. AxiSentinel tracks both layers and builds RegDef packages the moment a standard is stable enough to evaluate against.
Working papers to the ICAO Assembly and the Global Air Navigation Plan's automation thread set safety and human-responsibility principles for AI across certification, operations and air navigation.
Europe's working framework for machine learning in certified aviation products, built around a three-level classification of how much a system does without a human in the loop.
Brings AI embedded as a safety component of a product regulated under the EASA Basic Regulation (EU) 2018/1139 into the Act's high-risk regime.
The EU's drone traffic-management framework: identification, geo-awareness and tactical-deconfliction services across designated U-space airspace.
Replaces the current individual-waiver system with a published rule for routine beyond-visual-line-of-sight drone operations.
A powered-lift certification basis applied individually to each eVTOL manufacturer's design, rather than a single blanket standard.
A pro-innovation, risk-based strategy built on existing aviation regulation rather than a new AI-specific regime.
The only civil aviation authority to have issued a complete type, production, airworthiness and operating certificate stack for a passenger-carrying eVTOL aircraft.
General-purpose AI risk-management frameworks that already apply to any AI component inside an aviation system, flight-critical or ground-based.
From a single predictive-maintenance model to an airline's full flight-operations stack, AxiSentinel evaluates aviation AI against whichever standard actually applies, anywhere the aircraft, the drone or the airspace sits.
Aircraft makers, airlines and maintenance organizations use AI to support design trade studies, fleet planning and maintenance decisions. Aviation expects every safety-relevant choice to be traceable and approved.
Airlines, maintenance organizations and airports now use AI in operations, where information security is a safety matter. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel's core architecture changes for aviation. What changes is which RegDef packages are switched on and what telemetry the agents capture, from a flight-support system to a baggage scanner.
Agents capture flight-support, ATC decision-support, UAS/eVTOL flight-computer and MRO telemetry on the cadence you configure, Always On or scheduled, never limited to a periodic audit cycle.
Every telemetry event evaluated against whichever aviation safety, airspace-management or AI-specific rule set actually applies, per event.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, verifiable from the first event, built for the same scrutiny a safety investigator or a notified body would apply.
Tracks how much human judgment sits behind an AI-assisted flight, maintenance or air-traffic decision, the exact question EASA's Level 1 to Level 3 classification and the UK CAA's human-AI teaming principle both ask.
Ongoing evaluation of airport-security, biometric and ATC decision-support models for error-rate skew and decision transparency.
Engine-health and MRO decision models monitored against real fleet performance, not vendor benchmark data.
Built to the operational-authorization evidence a drone or eVTOL operator will need under FAA Part 108 and the EU's U-space framework.
A compliance-state change on one aircraft, drone fleet or ground system propagates network-wide as it happens.
AxiSentinel can run on avionics-adjacent networks, airline operations centers, airport systems and fully air-gapped government aviation facilities, zero network connectivity required.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it, not for a cockpit AI assistant and not for a baggage-screening model.
Evidence generated in-region to satisfy the data-handling rules of whichever civil aviation authority is involved, EASA, the FAA, the UK CAA, CAAC and GCC regulators included. Deployable in each operator's home region, so evidence for every civil aviation authority is generated and stored where that authority expects it.
The same architecture monitoring a robot fleet or a hospital's diagnostic AI now monitors a flight-control assistance system or an air-traffic decision-support tool. What changes is which RegDef packages are switched on.
Whether it's a single predictive-maintenance model or an airline's full flight-operations stack, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
AxiSentinel finds and controls AI agents, with continuous compliance evaluation, for hotels, resorts, booking platforms, cruise lines, short-term rentals and the commercial side of airlines and airports: the AI that sets the room rate and the fare, matches a guest’s face at check-in, flags a booking as fraud, answers the guest in the chat window and schedules the staff, evaluated against the pricing, consumer, privacy, biometric and AI rules of every market the guest books from and travels to.
Hotels, airlines and booking platforms were among the first industries to hand everyday decisions to AI: the rate on the screen, the upgrade offer, the fraud flag, the answer in the chat window. Until recently none of it was regulated as AI. In 2025 and 2026 pricing law, consumer law, biometric law and the EU AI Act all arrived at the front desk at once.
Revenue-management, booking and guest-messaging vendors each report on their own tools. AxiSentinel evaluates the whole stack, across every market a guest books from, with evidence a regulator, a court or a corporate travel buyer would accept.
Hospitality AI sits under pricing law, consumer law, privacy and biometric law and AI-specific law, in every market a guest books from and travels to. AxiSentinel tracks every layer and builds RegDef packages the moment a rule is stable enough to evaluate against.
The first horizontal AI law, applying in phases to every AI system a hotel, platform or carrier deploys toward guests or staff in the EU.
Booking.com is designated both a Very Large Online Platform under the DSA and a gatekeeper under the DMA, and every marketplace must explain its ranking and recommendation logic.
Biometric border registration for non-EU travelers, rolled out from 12 Oct 2025 and fully operational from 10 Apr 2026, with ETIAS pre-travel authorization postponed and no confirmed start date.
Biometric data is special-category data, and Europe’s data protection board has set the bar for face-based processing at airports and check-in.
Applies from 28 Jun 2025 to booking websites, mobile apps, e-tickets and passenger-transport services, including AI-driven search and chat interfaces.
In force since 12 May 2025 for hotels, inns and vacation-rental platforms.
In force since 1 Jan 2026. The Cartwright Act now expressly prohibits using or distributing a common pricing algorithm, one with two or more users that draws on competitor data.
In force since 10 November 2025 (General Business Law Section 349-A); the Second Circuit heard argument on 19 October 2026.
Issued by the NDRC, SAMR and CAC and in force from 10 Apr 2026, covering platforms and the merchants that sell through them.
The fastest-growing travel markets are writing their own AI and data rules.
General-purpose AI risk-management frameworks that already apply to every AI component in a hotel, platform or airline stack.
From a single hotel’s pricing engine to a global platform’s full booking stack, AxiSentinel evaluates hospitality AI against whichever rule actually applies, wherever the guest, the property and the data sit.
Hotels, airlines and travel platforms use AI for pricing, availability, fraud screening and guest service. Price transparency and consumer protection rules expect those decisions to be fair and explainable.
Hotels and travel brands use AI for bookings and guest service, and attackers use AI to impersonate both. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel’s core architecture changes for hospitality. What changes is which RegDef packages are switched on and what telemetry the agents capture, from a revenue-management engine to a check-in kiosk.
Agents capture revenue-management, booking-engine, guest-messaging and biometric-system telemetry on the cadence you configure, Always On or scheduled, never limited to a periodic audit cycle.
Every price change, booking decision and guest interaction evaluated against whichever pricing, consumer, privacy or AI rule set actually applies, per event.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, the kind of record a hotel needs to show how each rate was really set.
Captures which data sources fed each pricing recommendation, so a company can show its rates came from its own decisions and not from a shared competitor-data algorithm.
Detects prices that vary by a guest’s personal data or habits, the trigger for New York’s disclosure notice and China’s platform-pricing rules.
Ongoing evaluation of face-match and booking-fraud models for error-rate skew across guest groups.
Disclosure checks and answer-accuracy evidence for chatbots, voice concierges and AI booking agents.
A compliance-state change on one property, brand or platform propagates network-wide as it happens.
AxiSentinel can run alongside cloud property-management systems, on-premises hotel systems and in-region environments, or fully air-gapped.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it, not for a pricing model and not for a check-in camera.
Evidence generated and stored in the guest’s region, to satisfy GDPR, China’s PIPL, Gulf data-protection laws and every other regime a global hotel group or platform operates under.
The same architecture monitoring a bank’s credit model or a hospital’s diagnostic AI now monitors a room-pricing engine or a biometric check-in kiosk. What changes is which RegDef packages are switched on.
Whether it’s a single hotel’s pricing engine or a global platform’s full booking stack, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
AxiSentinel finds and controls AI agents, with continuous compliance evaluation, for retailers, grocers, online marketplaces, direct-to-consumer brands and the delivery platforms that serve them: the AI that sets the shelf price and the online price, ranks the product, writes the listing, screens the review, watches the store entrance, scores the return and answers the shopper in the chat window, evaluated against the pricing, consumer, privacy, biometric and AI rules of every market a shopper buys from.
Retailers and marketplaces handed everyday decisions to AI long before anyone called it AI: the price on the shelf label and the product page, the order of the search results, the review that gets published, the shopper flagged at the door. Between 2023 and 2026 pricing law, consumer law, biometric law and the EU AI Act all arrived at the checkout.
Pricing, personalization, review and loss-prevention vendors each report on their own tools. AxiSentinel evaluates the whole retail stack, across every market a shopper buys from, with evidence a regulator, a court or a marketplace auditor would accept.
Retail AI sits under pricing law, consumer law, privacy and biometric law and AI-specific law, in every market a shopper buys from. AxiSentinel tracks every layer and builds RegDef packages the moment a rule is stable enough to evaluate against.
The first horizontal AI law, applying in phases to every AI system a retailer or marketplace deploys toward shoppers or staff in the EU.
Amazon Store, AliExpress, Zalando, Shein and Temu are designated Very Large Online Platforms, and every online marketplace carries duties on its traders, its ranking and its interface design.
Personalization, pricing, fraud and loss-prevention AI all run on personal data, and the GDPR governs each of them.
The Omnibus Directive has applied since 28 May 2022, and the Commission plans its Digital Fairness Act proposal for the fourth quarter of 2026.
The CMA has enforced consumer law directly since 6 Apr 2025, with fines of up to 10% of global turnover, and opened its first formal investigations in November 2025, three of them into online homeware retailers over pressure selling.
In force since 21 Oct 2024 for every business that sells to US consumers.
The FTC’s December 2023 action against Rite Aid set the federal benchmark for in-store facial recognition, and Illinois law sets statutory damages for biometric capture without consent.
In force since November 2025 (General Business Law Section 349-A).
Three states enacted laws in 2026 restricting prices set from a shopper’s personal data, starting with groceries.
The CPPA’s regulations took effect on 1 Jan 2026, with staggered compliance dates.
Issued by the NDRC, SAMR and CAC and in force from 10 Apr 2026, covering platforms and the merchants that sell through them.
General-purpose AI risk-management frameworks that already apply to every AI component in a retail or marketplace stack.
From a single grocer’s pricing engine to a global marketplace’s full storefront, AxiSentinel evaluates retail AI against whichever rule actually applies, wherever the shopper, the store and the data sit.
Retailers use AI to plan assortments, inventory, sourcing and promotions. Decisions with customer and supplier effects need a rationale that teams and auditors can follow.
Retail AI faces customers directly, so manipulation, fraud and data leaks show up fast and in public. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel’s core architecture changes for retail. What changes is which RegDef packages are switched on and what telemetry the agents capture, from an e-commerce pricing engine to a camera at the store entrance.
Agents capture pricing-engine, e-commerce storefront, marketplace, chatbot and in-store vision telemetry on the cadence you configure, Always On or scheduled, never limited to a periodic audit cycle.
Every price change, ranking decision, order block and shopper interaction evaluated against whichever pricing, consumer, privacy or AI rule set actually applies, per event.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, the kind of record a retailer needs to show how each price was really set.
Detects prices that vary by a shopper’s personal data or habits, the trigger for New York’s notice, the Maryland, Connecticut and New Jersey bans and China’s platform-pricing rules.
Captures which data fed each price and what the shopper actually saw, from the headline price to the discount claim and the final total.
Ongoing evaluation of facial-recognition, checkout-vision, returns and payment-fraud models for error-rate skew across shopper groups, the gaps the FTC found at Rite Aid.
Disclosure checks and answer-accuracy evidence for product-advice chatbots, voice agents and AI shopping agents acting for the customer.
A compliance-state change on one store, banner or marketplace propagates network-wide as it happens.
AxiSentinel can run alongside cloud commerce platforms, on-premises store systems and in-region environments, or fully air-gapped.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it, not for a pricing engine and not for a store camera.
Records how products are ranked and recommended and how reviews are screened, for DSA transparency duties and fake-review rules on both sides of the Atlantic.
The same architecture monitoring a bank’s credit model or a hospital’s diagnostic AI now monitors a grocery pricing engine or a marketplace recommender. What changes is which RegDef packages are switched on.
Whether it’s a single grocer’s pricing engine or a global marketplace’s full storefront, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
AxiSentinel finds and controls AI agents, with continuous compliance evaluation, for social networks, video-sharing and livestreaming services, marketplaces, search engines, app stores and messaging platforms: the AI that ranks the feed, recommends the next video, removes the post, estimates a user’s age, targets the ad and labels the deepfake, evaluated against the platform, online-safety, child-protection, privacy and AI rules of every market the platform serves.
Online platforms run on AI: the feed a user sees, the post that comes down, the ad that gets served, the age a face is estimated to be. For years platforms reported on that AI in their own words. In 2025 and 2026 regulators in Europe, the UK, Australia, Brazil, India and the United States started asking for proof.
Moderation, age-assurance and ad-tech vendors each report on their own tools, and transparency reports describe outcomes after the fact. AxiSentinel evaluates the whole platform stack continuously, across every market it serves, with evidence an auditor, a regulator or a court would accept.
Platform AI sits under platform regulation, online-safety law, child protection, privacy law and AI-specific law, in every market the platform serves. AxiSentinel tracks every layer and builds RegDef packages the moment a rule is stable enough to evaluate against.
The first horizontal AI law, applying in phases to the ranking, moderation, generative and age-estimation AI a platform deploys toward users in the EU.
Very large online platforms and search engines, those with more than 45 million monthly active users in the EU, must assess and mitigate systemic risks and submit to a yearly audit.
Every online platform must explain the main parameters behind its recommender systems and how users can change them.
Article 28 requires a high level of privacy, safety and security for minors, and the Commission’s guidelines of 14 Jul 2025 are its benchmark for compliance.
Profiling for feeds and ads, biometric age estimation and automated account decisions all process personal data at scale.
Ofcom’s codes apply to user-to-user and search services with links to the UK, wherever the platform is based.
Two federal rules enforced by the FTC that reach the core of platform moderation and children’s data.
States are moving age checks to the app store and the operating system, and regulating algorithmic feeds for minors.
In force since 10 Dec 2025: age-restricted platforms must take reasonable steps to prevent under-16s from holding accounts.
Brazil’s digital statute for children and adolescents, fully in force since its grace period ended on 17 Mar 2026 and supervised by the ANPD.
Two of Asia’s largest digital markets now set hard clocks and labeling duties for platforms.
General-purpose AI risk-management frameworks that already apply to every AI component in a platform stack.
From a single community app’s moderation model to a very large platform’s full ranking, safety and ads stack, AxiSentinel evaluates platform AI against whichever rule actually applies, wherever the user, the service and the data sit.
Platforms rely on AI to rank feeds, moderate content and assure age. The EU Digital Services Act and online safety laws expect statements of reasons, risk assessments and consistent enforcement.
Platforms face AI-scaled abuse every day, and regulators now expect them to assess and reduce it. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel’s core architecture changes for online platforms. What changes is which RegDef packages are switched on and what telemetry the agents capture, from a feed-ranking model to an age-estimation check.
Agents capture ranking, moderation, age-assurance and ad-delivery telemetry on the cadence you configure, Always On or scheduled, never limited to a periodic audit cycle.
Every ranking decision, moderation action and ad impression evaluated against whichever platform, online-safety, privacy or AI rule set actually applies, per event.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, the kind of record a platform needs to show its auditor and its regulator how each control really performed.
Captures the parameters behind each ranked feed and confirms the non-profiling option is live, for DSA Articles 27 and 38.
Ongoing precision, recall and appeal-reversal tracking for trust and safety classifiers, by language, region and content type.
False positive and false negative rates for age-estimation models, tracked across age bands and demographic groups.
Label and provenance-marker coverage on AI-generated content, and disclosure checks on in-app AI assistants.
A compliance-state change on one service, region or feature propagates network-wide as it happens.
AxiSentinel can run alongside cloud and data-center platform infrastructure and in-region environments, or fully air-gapped.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it, not for a feed-ranking model and not for an age-estimation system.
Evidence packaged for DSA annual audits, Ofcom information requests and national regulators, without rebuilding it for each one.
The same architecture monitoring a bank’s credit model or a hospital’s diagnostic AI now monitors a recommender system or a moderation classifier. What changes is which RegDef packages are switched on.
Whether it’s a single app’s moderation model or a very large platform’s full ranking and safety stack, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
AxiSentinel finds and controls AI agents, with continuous compliance evaluation, for pharmaceutical and biotech companies, CDMOs and CROs: the AI that inspects the vial, reviews the batch record, triages the deviation, codes the adverse event, picks the trial site, drafts the submission and answers the doctor’s question, evaluated against the GxP, AI, data-protection and medicines rules of every market where the product is developed, made and sold.
Pharma and biotech now use AI at every step from target to patient: the model that screens molecules, the camera that inspects the vial, the engine that triages the safety case, the tool that drafts the clinical study report. GxP rules were written for software that behaves the same way every time. In 2025 and 2026 regulators began writing the rules for software that learns.
AI vendors validate their own tools, and computerized-system validation captures a model once, at go-live. AxiSentinel evaluates the whole stack continuously, from discovery to safety, with evidence a GxP inspector, a regulatory assessor or a licensing partner would accept.
Pharma AI sits under GxP rules, medicines law, data-protection law and AI-specific law, in every market where a product is developed, made and sold. AxiSentinel tracks every layer and builds RegDef packages the moment a rule is stable enough to evaluate against.
The first horizontal AI law. AI used solely for scientific research and development is exempt, but AI in devices, diagnostics, the workforce and general-purpose models is not.
The first GMP rules written for AI. The drafts went to consultation from 7 Jul to 7 Oct 2025, and EU inspectors are targeting a final text for the European Commission in Q4 2026.
Adopted in September 2024, the reflection paper sets EMA’s expectations for AI across the medicinal product lifecycle, backed by a multi-annual AI workplan running to 2028.
Issued in January 2025 for drugs and biological products and still in draft. Drug discovery is out of scope; everything that feeds a safety, effectiveness or quality decision is in.
Ten joint principles published on 14 Jan 2026, the first shared transatlantic baseline for AI in drug development.
Electronic records and signatures rules apply to every GxP record an AI system creates, changes or relies on.
E6(R3) took effect in the EU on 23 Jul 2025 and was published by FDA on 9 Sep 2025. M15, adopted on 29 Jan 2026, covers model-informed drug development, including AI and machine learning.
The industry reference points for validating AI in GxP work: the CIOMS Working Group XIV report on AI in pharmacovigilance (December 2025) and the ISPE GAMP Guide: Artificial Intelligence (2025).
Health and genetic data are special-category data under GDPR. The EHDS Regulation, in force since March 2025, opens secondary use of health data for research and innovation from March 2029.
The largest reform of EU medicines law in two decades, adopted by the Council and awaiting the final European Parliament vote, with full application foreseen from 2028.
Two major regulators are building AI into how medicines are developed, inspected and supervised.
General-purpose AI risk-management frameworks that already apply to every AI component in a discovery, clinical, manufacturing or safety stack.
From a single visual-inspection line to an enterprise portfolio of discovery, clinical, quality and safety models, AxiSentinel evaluates pharma AI against whichever rule actually applies, wherever the site, the study and the data sit.
Pharmaceutical and biotech teams use AI to prioritize programs, design studies and plan manufacturing. Decisions that commit years of investment and affect patients need a rationale that regulators, boards and partners can follow.
Pharma AI touches research, manufacturing and quality data, where integrity and confidentiality are regulated. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel’s core architecture changes for pharma and biotech. What changes is which RegDef packages are switched on and what telemetry the agents capture, from a visual-inspection line to a pharmacovigilance intake engine.
Agents capture manufacturing, quality, clinical, pharmacovigilance and medical-information telemetry on the cadence you configure, Always On or scheduled, never limited to a periodic audit cycle.
Every inspection result, triage decision and AI-generated record evaluated against whichever GxP, data-protection or AI rule set actually applies, per event.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, the kind of record a GxP inspector expects to see behind every AI-assisted decision.
Captures each model’s question of interest, context of use, risk rating and validation results, ready for FDA’s credibility framework and EMA’s risk-based expectations.
Tests whether models in critical GMP applications are static and deterministic, whether test data stayed separate from training data, and whether confidence and explainability are logged.
Ongoing evaluation of inspection, triage, safety and recruitment models for error rates, drift and skew across products, sites and patient groups.
Source-traceability and factual-accuracy evidence for AI-drafted submissions, safety narratives, medical-information answers and promotional material.
A compliance-state change on one line, site, study or product propagates network-wide as it happens.
AxiSentinel can run alongside cloud quality and clinical systems, on-premises manufacturing networks and in-region environments, or fully air-gapped.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it, not for a visual-inspection model and not for a safety-case triage tool.
Records who, or which model version, created or changed each GxP record and when, aligned to Part 11, Annex 11 and data-integrity expectations.
The same architecture monitoring a bank’s credit model or a hospital’s diagnostic AI now monitors a visual-inspection line or a pharmacovigilance intake engine. What changes is which RegDef packages are switched on.
Whether it’s a single visual-inspection model or an enterprise portfolio of discovery, clinical and safety AI, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
AxiSentinel finds and controls AI agents, with continuous compliance evaluation, for discrete and process manufacturers, from automotive suppliers, electronics and machinery builders to chemicals and metals producers: the AI that inspects the part, predicts the failure, tunes the process, steers the robot, watches the safety zone and schedules the line, evaluated against the product-safety, liability, cybersecurity, data and AI rules of every market a plant ships into.
Plants have run on models for years: the camera that passes or rejects a part, the model that predicts a bearing failure, the recommender that nudges a setpoint. Until recently none of it was regulated as AI. Between 2024 and 2027, product-safety law, liability law, cybersecurity law and the EU AI Act all arrive on the factory floor.
Machine-vision, MES, robot and maintenance vendors each report on their own tools. AxiSentinel evaluates the whole plant stack, across every market the product ships into, with evidence a notified body, a court or an OEM customer would accept.
Industrial AI sits under product-safety law, liability law, cybersecurity law, data law and AI-specific law, in every market a plant ships into. AxiSentinel tracks every layer and builds RegDef packages the moment a rule is stable enough to evaluate against.
The first horizontal AI law, applying in phases to AI a manufacturer deploys toward its workforce and to AI built into the products it sells, as amended by the AI Omnibus, Regulation (EU) 2026/1744.
Replaces the Machinery Directive from 20 Jan 2027 and is the first EU product-safety law written with machine learning in mind.
Transposition deadline 9 Dec 2026. Software, including AI systems, is now a product, and strict liability follows it.
Reporting duties apply since 11 Sep 2026 and the full regulation from 11 Dec 2027, covering connected machinery, controllers and industrial software.
Manufacturing of machinery, motor vehicles, electrical equipment, electronics and medical devices, and of chemicals, are listed sectors.
Two horizontal laws that reach connected and AI-enabled products.
The definitive period began on 1 Jan 2026 for imports of iron, steel, aluminium, cement, fertilisers, hydrogen and electricity.
The engineering standards notified bodies and courts measure industrial AI against.
OSHA has no robot-specific standard. Robot-system citations rest on the General Duty Clause, lockout/tagout and machine guarding, read against consensus standards.
The largest manufacturing economies in Asia are writing AI into law on their own terms.
General-purpose AI risk-management frameworks that already apply to every AI component in a plant, from the vision station to the scheduling engine.
From a single vision station to a multi-plant production network, AxiSentinel evaluates manufacturing AI against whichever rule actually applies, wherever the machine, the product and the data sit.
Manufacturers use AI across product design, sourcing and process changes, often working from digital twins and engineering models. Each decision needs a rationale that quality, safety and customers can rely on.
Factories connect AI to machines, quality checks and supply chains, so a cyber incident can stop production or affect safety. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel’s core architecture changes for manufacturing. What changes is which RegDef packages are switched on and what telemetry the agents capture, from a vision-inspection station to a robot controller.
Agents capture inspection, process-control, MES, robot-controller and maintenance-system telemetry on the cadence you configure, Always On or scheduled, never limited to a periodic audit cycle.
Every inspection call, setpoint change and safety-relevant event evaluated against whichever product-safety, cybersecurity, liability or AI rule set actually applies, per event.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, the kind of record a manufacturer needs to show what its AI decided, and on which model version.
Captures the safety-related decision data and safety-software version history the Machinery Regulation requires for machine-learning safety functions.
Ongoing evaluation of defect-detection and failure-prediction models for drift across lines, shifts, materials and product variants.
Links anomaly detections to Cyber Resilience Act and NIS2 reporting deadlines, so a manufacturer can show when it knew and when it reported.
Keeps model versions, training-data lineage and validation results in the form a court can order disclosed under the revised Product Liability Directive.
A compliance-state change on one line, plant or product family propagates network-wide as it happens.
AxiSentinel can run alongside cloud MES and analytics platforms, on-premises plant systems and in-region environments, or fully air-gapped for isolated OT networks.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it, not for an inspection model and not for a robot safety function.
Traces supplier and emissions data from source to CBAM declaration and sustainability report, generated and stored in the region where each plant operates.
The same architecture monitoring a bank’s credit model or a hospital’s diagnostic AI now monitors a vision-inspection model or a collaborative robot cell. What changes is which RegDef packages are switched on.
Whether it’s a single inspection cell or a global production network, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
AxiSentinel finds and controls AI agents, with continuous compliance evaluation, for landlords, property managers, mortgage lenders, brokerages, listing portals and the software vendors that serve them: the AI that values the home, scores the rental applicant, recommends the rent, underwrites the mortgage, targets the listing and answers the prospective tenant in the chat window, evaluated against the fair-housing, fair-lending, antitrust, privacy and AI rules of every market where the property and the applicant sit.
Real estate handed some of its most consequential decisions to AI early: the value on the appraisal, the score on the rental application, the rent on the renewal letter, the audience for the listing. In 2025 and 2026 a federal valuation rule, a federal antitrust settlement, state and city rent-algorithm laws and the EU AI Act all arrived at the leasing office and the loan desk at once.
Valuation, screening and revenue-management vendors each report on their own tools. AxiSentinel evaluates the whole stack, across every jurisdiction a portfolio spans, with evidence a regulator, a court or a fair-housing plaintiff would accept.
Real estate AI sits under fair-housing law, fair-lending and credit-reporting law, antitrust law, privacy law and AI-specific law, from the city ordinance to the EU regulation. AxiSentinel tracks every layer and builds RegDef packages the moment a rule is stable enough to evaluate against.
The first horizontal AI law, applying in phases to every AI system a lender, landlord or platform deploys toward applicants and residents in the EU.
In Case C-634/21 (7 Dec 2023) the Court of Justice held that generating a credit score can itself be an automated decision under Article 22 when a third party relies on it heavily.
Directive (EU) 2024/1275 entered into force on 28 May 2024, with national transposition due by 29 May 2026.
Issued by the OCC, Federal Reserve, FDIC, NCUA, CFPB and FHFA, and in force since 1 Oct 2025 for mortgages secured by a consumer’s principal dwelling.
Prohibits discrimination in renting, selling, financing and advertising housing, and courts continue to apply the disparate-impact framework the Supreme Court recognized in 2015.
Tenant-screening reports are consumer reports, and mortgage underwriting is credit, so both carry accuracy and explanation duties whatever model sits behind them.
In force since 1 Jan 2026. The Cartwright Act now expressly prohibits using or distributing a common pricing algorithm, one with two or more users that draws on competitor data.
Signed on 16 Oct 2025 and effective 15 Dec 2025, adding Section 340-B to the Donnelly Act for residential rentals.
The proposed federal settlement and more than a dozen city and county ordinances now define what rent-pricing software may use.
Signed on 14 May 2026, repealing and replacing the 2024 Colorado AI Act, and effective from 1 Jan 2027.
The first phase applied from 1 May 2026 across the private rented sector in England.
General-purpose AI risk-management frameworks that already apply to every AI component in a lender, landlord or platform stack.
From a single owner’s rent-pricing engine to a national lender’s full valuation and underwriting stack, AxiSentinel evaluates real estate AI against whichever rule actually applies, wherever the property, the applicant and the data sit.
Lenders, landlords and property managers use AI for valuations, tenant screening and investment decisions. Fair housing rules apply to these decisions in full.
Real estate deals move large sums on short timelines, which AI-powered fraud exploits. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel’s core architecture changes for real estate. What changes is which RegDef packages are switched on and what telemetry the agents capture, from an automated valuation model to a leasing chatbot.
Agents capture valuation-model, screening-score, rent-pricing and leasing-agent telemetry on the cadence you configure, Always On or scheduled, never limited to a periodic audit cycle.
Every valuation, screening decision, rent recommendation and applicant interaction evaluated against whichever housing, lending, antitrust, privacy or AI rule set actually applies, per event.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, the kind of record a landlord or lender needs to show how each rent, score or valuation was really set.
Captures which data sources fed each rent recommendation and how old the competitor data was, so an owner can show its rents came from its own decisions.
Detects approval, pricing and valuation gaps across protected groups and voucher holders, the evidence fair-housing and fair-lending claims turn on.
Confidence, manipulation, conflict, sample-testing and nondiscrimination evidence for every automated valuation model in use.
Disclosure checks and answer-accuracy evidence for leasing chatbots, voice agents and AI application assistants.
A compliance-state change on one property, portfolio or lending channel propagates network-wide as it happens.
AxiSentinel can run alongside cloud property-management and loan-origination systems, on-premises servicing systems and in-region environments, or fully air-gapped.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it, not for a valuation model and not for a tenant-screening score.
Records the reasons behind each declined application, loan or renewal and checks them against what the model actually used, for FCRA, Regulation B, GDPR and Colorado notices.
The same architecture monitoring a bank’s credit model or a hospital’s diagnostic AI now monitors a rent-pricing engine or an automated valuation model. What changes is which RegDef packages are switched on.
Whether it’s a single owner’s rent-pricing engine or a national lender’s full valuation stack, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
AxiSentinel finds and controls AI agents, with continuous compliance evaluation, for shipowners and operators, ports and terminals, freight forwarders, customs brokers, warehouse operators and last-mile carriers: the AI that keeps watch on the bridge, plans the voyage and reports the emissions, moves the crane, scores the container for risk, paces the warehouse shift and routes the delivery van, evaluated against the IMO, class, cyber, emissions, customs, workforce and AI rules of every flag, port and market the cargo passes through. The IMO’s code for autonomous and remotely operated ships has applied on a non-mandatory basis since 1 July 2026.
Ships, ports and logistics networks have handed more and more decisions to software: the route, the speed, the crane move, the container held for inspection, the pace of the warehouse shift. Until recently none of it was regulated as AI. Between 2024 and 2027, autonomy, cyber, emissions, customs, workforce and AI rules all arrive on the same fleets and terminals.
Bridge, terminal, routing and warehouse vendors each report on their own systems. AxiSentinel evaluates the whole stack, across every flag, port and market the cargo passes through, with evidence a flag state, a regulator, an insurer or a court would accept.
Maritime and logistics AI sits under IMO and class rules, cyber law, climate law, customs law, workforce law and AI-specific law, in every jurisdiction a ship calls at or a shipment crosses. AxiSentinel tracks every layer and builds RegDef packages the moment a rule is stable enough to evaluate against.
The first horizontal AI law, applying in phases to the AI a carrier, port, forwarder or warehouse deploys toward customers, workers or infrastructure in the EU.
Adopted at the IMO Maritime Safety Committee’s 111th session in May 2026 and applying from 1 Jul 2026, a goal-based code for cargo ships covered by SOLAS.
Cyber risk is part of the ship’s safety management system, and class rules now set cyber-resilience requirements for the ship and its equipment.
In force since 16 Jul 2025 for US-flagged vessels, Outer Continental Shelf facilities and port facilities regulated under the Maritime Transportation Security Act.
Transport is a sector of high criticality, and water transport companies, ports and vessel traffic services are named in Annex I.
Two climate laws that turn fuel, voyage and emissions data into money, and the AI models that produce or optimize that data into compliance systems.
Customs is moving from paper declarations to data-driven risk analysis, and freight documents are going digital.
Algorithmic management of drivers, riders and warehouse staff is now regulated on both sides of the Atlantic.
Class societies are writing the technical assurance rules that flag states and insurers lean on for AI-enabled and autonomous functions.
Two of the region’s major shipbuilding, port and manufacturing-export economies now have comprehensive AI laws.
General-purpose AI risk-management frameworks that already apply to every AI component in a fleet, terminal or logistics stack.
From a single vessel’s collision-avoidance system to a global carrier’s full fleet, terminal and warehouse stack, AxiSentinel evaluates maritime and logistics AI against whichever rule actually applies, wherever the ship, the cargo and the data sit.
Shipping lines and port operators use AI to plan fleets, routes and terminal investments. Decisions with safety, emissions and commercial effects need a rationale that regulators and partners can follow.
Ships and ports rely on navigation, logistics and AI systems that can be spoofed or held to ransom. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel’s core architecture changes for maritime and logistics. What changes is which RegDef packages are switched on and what telemetry the agents capture, from a ship’s bridge to a terminal crane to a warehouse floor.
Agents capture bridge, engine-room, terminal-automation, customs-screening and warehouse-system telemetry on the cadence you configure, Always On or scheduled, never limited to a periodic audit cycle.
Every navigation recommendation, risk score, routing decision and workforce action evaluated against whichever IMO, cyber, emissions, customs, workforce or AI rule set actually applies, per event.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, the kind of record an operator needs to show what the AI saw and decided before an incident.
Captures each autonomous or remote function’s inputs, recommendations and human interventions, so an operator can show how the ship was controlled and who could intervene.
Traces the fuel, voyage and emissions figures that AI models produce or optimize back to their data sources and model versions, before they reach a verifier.
Ongoing evaluation of customs-risk, fraud, pick-rate and dispatch models for error-rate skew across shippers, lanes and worker groups.
Detection coverage and incident-handling evidence for shipboard and terminal OT, mapped to the Coast Guard cyber rule, NIS2 and class cyber-resilience requirements.
A compliance-state change on one vessel, terminal or warehouse propagates fleet-wide and network-wide as it happens.
AxiSentinel can run aboard vessels, inside terminal OT networks, in cloud logistics platforms and in-region environments, or fully air-gapped for ships with limited connectivity.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it, not for a collision-avoidance model and not for a customs risk score.
Evidence generated and stored where the flag state, port state or customs authority expects it, to satisfy GDPR and every other regime a global carrier or forwarder operates under.
The same architecture monitoring a bank’s credit model or a hospital’s diagnostic AI now monitors a collision-avoidance system or a terminal crane. What changes is which RegDef packages are switched on.
Whether it’s a single vessel’s navigation AI or a global carrier’s full fleet, terminal and warehouse stack, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
AxiSentinel finds and controls AI agents, with continuous compliance evaluation, for the vendors and deployers of face, voice and fingerprint recognition, liveness and presentation attack detection, identity verification and remote onboarding, age assurance and digital identity wallets: the AI that decides whether a face matches, whether the person in front of the camera is real, whether a document is genuine and whether a user is old enough, evaluated against the biometric, privacy, identity, anti-money-laundering and AI rules of every market where a person is enrolled or verified. The EU age verification app is ready for national rollout by the end of 2026, and California requires operating-system age signals from 1 January 2027.
Face, voice and fingerprint matching moved from border posts and phones into everyday onboarding, payments, age checks and time clocks, and the match, the liveness check and the age estimate are each decided by an AI model. Courts, attorneys general and data protection authorities have already put a price on getting it wrong, and between 2025 and 2027 the EU AI Act, eIDAS 2.0 and the AMLR turn biometric accuracy and identity assurance into regulated evidence.
Algorithm vendors publish benchmark results and verification providers report on their own pipelines. AxiSentinel evaluates the whole deployed stack, on the deployer’s real population and in every market it serves, with evidence a regulator, a court or a wallet certifier would accept.
Biometric and identity AI sits under AI law, privacy and biometric law, digital identity law, anti-money-laundering rules and technical test standards, in every market where a person is enrolled or verified. AxiSentinel tracks every layer and builds RegDef packages the moment a rule is stable enough to evaluate against.
The first horizontal AI law treats biometrics as its most sensitive category, with outright bans, transparency duties and high-risk obligations applying in phases.
Regulation (EU) 2024/1183 requires every member state to offer at least one EU Digital Identity Wallet by December 2026, built and certified to common implementing acts.
Biometric data used to identify a person is special-category data, and processing is prohibited unless an Article 9 exception applies.
Regulation (EU) 2024/1624 applies from 10 Jul 2027, replacing national rules with a single customer due diligence rulebook, with the new AMLA taking direct supervision of selected groups from 2028.
The most litigated biometric law in the world, with a private right of action and written-release requirements before any biometric is captured.
Enforced by the Texas Attorney General, with penalties of up to $25,000 per violation.
A new generation of state laws that reach organizations collecting any amount of biometric data, not only large data businesses.
The FTC’s December 2023 action banned Rite Aid from using facial recognition for five years after false matches that the agency said fell harder on some racial and gender groups.
NIST’s Digital Identity Guidelines, finalized in July 2025, set the federal bar for identity proofing and authentication, and TSA now accepts mobile driver’s licenses from approved states.
The test methods buyers, regulators and wallet certification schemes point to when they ask whether a biometric system actually works.
Identity and face-recognition rules are being written into statute well beyond Europe and the US.
General-purpose AI risk-management frameworks that already apply to every model in a biometric or identity stack.
From a single liveness check to a global onboarding and identity stack, AxiSentinel evaluates biometric and identity AI against whichever rule actually applies, wherever the person, the template and the data sit.
Banks, employers and agencies use biometric AI to decide who is verified, flagged or admitted. Biometric privacy laws and the EU AI Act make these some of the most closely scrutinized decisions AI supports.
Biometric AI is attacked with deepfakes and injected images, and biometric data cannot be reset once stolen. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel’s core architecture changes for biometrics and digital identity. What changes is which RegDef packages are switched on and what telemetry the agents capture, from a face matcher to a wallet relying-party integration.
Agents capture matching, liveness, document-check and onboarding-decision telemetry on the cadence you configure, Always On or scheduled, never limited to a periodic audit cycle.
Every match, rejection and onboarding decision evaluated against whichever biometric, privacy, identity or AI rule set actually applies, per event.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, the kind of record a deployer needs to show what a biometric system decided and why.
False match and false non-match rates broken down by age, sex and skin tone on live traffic, with alerts when a group drifts away from the rest.
Spoof, replay and injected-media detection results recorded per release, aligned to ISO/IEC 30107-3 and CEN/TS 18099 test methods.
Captures when notice was given, when consent was recorded and when each template was deleted, the facts BIPA, CUBI and Colorado claims turn on.
Accuracy around legal age thresholds tracked by group, so age-assurance decisions rest on measured error rates rather than vendor claims.
A compliance-state change on one deployment, product or market propagates network-wide as it happens.
AxiSentinel can run alongside cloud verification services, on-premises matching systems and in-region environments, or fully air-gapped.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it, not for a face matcher and not for an age estimator.
Evidence for digital identity wallet providers and the banks and platforms that rely on them, mapped to eIDAS 2.0 and AMLR duties.
The same architecture monitoring a bank’s credit model or a hospital’s diagnostic AI now monitors a face matcher or a liveness check. What changes is which RegDef packages are switched on.
Whether it’s a single liveness check or a global identity verification stack, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
AxiSentinel finds and controls AI agents, with continuous compliance evaluation, for customer service operations, in-house contact centers, outsourced BPO sites and the software vendors behind them: the chatbot that answers the customer, the voice bot that takes the call, the assistant that prompts the human agent, the analytics that score the agent’s performance and the AI that places the outbound call, evaluated against the AI, consumer, privacy, telemarketing and accessibility rules of every market the customer calls from. Since 2 August 2026, the EU AI Act has required that customers be told when they are talking to an AI.
Customer service was one of the first functions to hand conversations to AI: the chatbot on the website, the voice bot on the phone line, the suggestion on the agent’s screen, the score on the agent’s review. For years none of it was regulated as AI. Between 2024 and 2026 telemarketing law, consumer law, privacy law and the EU AI Act all reached the contact center at once.
Contact-center platforms, bot vendors and analytics providers each report on their own tools. AxiSentinel evaluates the whole conversation, across every channel and every market a customer calls from, with evidence a regulator, a court or an enterprise client would accept.
Customer service AI sits under AI-specific law, consumer law, privacy and recording law, telemarketing law and accessibility law, in every market a customer calls from. AxiSentinel tracks every layer and builds RegDef packages the moment a rule is stable enough to evaluate against.
The first horizontal AI law, applying in phases to every chatbot, voice bot and analytics tool a business deploys toward customers or agents in the EU.
Every recorded call, chat transcript and voiceprint is personal data, and some customer service decisions are made with no person involved at all.
Two directives give consumers of financial services a legal path from the machine to a person.
Applies from 28 Jun 2025 to e-commerce, banking, consumer communications and passenger-transport services, including their customer support.
Since the FCC’s declaratory ruling of 8 Feb 2024, an AI-generated voice is an “artificial” voice under the Telephone Consumer Protection Act.
A growing set of states require businesses to tell customers when they are talking to a machine.
California requires the consent of every party before a confidential call is recorded, and AI that listens to customer calls is now being tested against that rule in court.
The CFPB’s June 2023 report on chatbots in consumer finance found that about 37% of the US population engaged with a bank’s chatbot in 2022.
On 14 Feb 2024 the British Columbia Civil Resolution Tribunal held Air Canada liable for negligent misrepresentation by its website chatbot.
UK regulators judge the customer outcome, not the channel that delivered it.
Asia’s largest customer service markets now require AI to identify itself.
General-purpose AI risk-management frameworks that already apply to every AI component in a customer service stack.
From a single website chatbot to a global contact-center operation spanning in-house and outsourced sites, AxiSentinel evaluates customer service AI against whichever rule actually applies, wherever the customer, the agent and the data sit.
Contact centers use AI to route calls, suggest answers, score agents and decide when to escalate. Customers and regulators increasingly ask how those decisions were made.
Voice AI and agents now answer customers, and attackers use cloned voices to get past them. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel’s core architecture changes for customer service. What changes is which RegDef packages are switched on and what telemetry the agents capture, from a web chatbot to an outbound voice campaign.
Agents capture chatbot, voice-bot, agent-assist, speech-analytics and outbound-dialer telemetry on the cadence you configure, Always On or scheduled, never limited to a periodic audit cycle.
Every bot reply, call event, escalation and QA score evaluated against whichever AI, consumer, privacy or telemarketing rule set actually applies, per event.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, the kind of record a business needs to show what its AI actually told a customer.
Confirms that each conversation disclosed the AI where the law requires it and that a working route to a person was offered, in every channel and language.
Bot and agent-assist answers checked against the company’s own policies, prices and terms, so a wrong promise is caught before it becomes a liability.
Ongoing evaluation of QA scoring, sentiment and routing models for skew across accents, languages and customer groups.
Records the consent behind every recorded call and every outbound AI-voice call, and confirms that synthetic voices are labeled and never impersonate a real person.
A compliance-state change on one queue, brand or BPO site propagates network-wide as it happens.
AxiSentinel can run alongside cloud contact-center platforms, on-premises telephony and in-region environments, or fully air-gapped.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it, not for a chatbot and not for an agent QA score.
Verifies that personal and payment data is redacted from transcripts and training data, and that evidence is generated and stored in the customer’s region under GDPR and every other regime a global operation runs under.
The same architecture monitoring a bank’s credit model or a hospital’s diagnostic AI now monitors a voice bot or an agent-assist model. What changes is which RegDef packages are switched on.
Whether it’s a single website chatbot or a global contact-center operation, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
AxiSentinel finds and controls AI agents, with continuous compliance evaluation, for online casinos, sportsbooks, lotteries, land-based casinos and video game publishers: the AI that flags a player at risk of harm, decides who receives a bonus, matches a face against a self-exclusion list, scores a deposit for money-laundering risk, sets the odds and prices the loot box, evaluated against the gambling, consumer, anti-money-laundering, privacy and AI rules of every market where the player logs in.
Operators and publishers handed everyday decisions to AI years ago: who looks at risk, who gets the free bet, which face matches the exclusion list, which deposit looks like laundering, what the loot box costs. Regulators first required the monitoring, and are now asking how the models behind it, and behind the offers, actually work.
Platform, odds, KYC and responsible-gambling vendors each report on their own tools. AxiSentinel evaluates the whole stack, across every license an operator holds, with evidence a gambling regulator, an AML supervisor or a court would accept.
Gaming and gambling AI sits under license conditions, consumer law, anti-money-laundering law, privacy law and AI-specific law, in every market a player logs in from. AxiSentinel tracks every layer and builds RegDef packages the moment a rule is stable enough to evaluate against.
The first horizontal AI law, applying in phases to every AI system an operator or publisher deploys toward players or staff in the EU.
Player-risk scores, affordability flags and offer targeting are all profiling, and many of the decisions they drive affect players significantly.
A single, directly applicable AML rulebook that applies from 10 Jul 2027, replacing national transpositions of the directives.
EU consumer authorities published key principles on in-game virtual currencies on 21 Mar 2025 and launched coordinated action against nine video game companies on 30 Sep 2026.
The Gambling Commission’s customer interaction rules make automated harm detection a license condition for remote operators.
Two measures from the 2023 White Paper, High stakes: gambling reform for the digital age, that turn player data into hard limits and checks.
Two of Europe’s most data-driven regimes, built on central limit systems and mandatory duty-of-care checks.
In January 2025 the developer of Genshin Impact agreed to pay $20M to settle FTC charges over loot boxes sold to children and teens.
States are moving from general responsible-gaming duties to rules aimed directly at AI personalization.
Two of the largest newly regulated online markets in the Americas.
National rules that reach every licensed online wagering provider and every game sold in the country.
General-purpose AI risk-management frameworks that already apply to every AI component in an operator’s or publisher’s stack.
From a single sportsbook’s harm-detection model to a global operator’s or publisher’s full player stack, AxiSentinel evaluates gaming and gambling AI against whichever rule actually applies, wherever the player, the license and the data sit.
Game studios and gambling operators use AI to moderate, match players, personalize offers and flag risk. Player protection and minor safety rules expect those decisions to be consistent and explainable.
Games hold accounts, payments and young players, and AI makes cheating, fraud and abuse easier to scale. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel’s core architecture changes for gaming and gambling. What changes is which RegDef packages are switched on and what telemetry the agents capture, from a player-risk model to a casino entrance camera.
Agents capture wagering, deposit, limit, offer and player-contact telemetry on the cadence you configure, Always On or scheduled, never limited to a periodic audit cycle.
Every bet, deposit, offer and intervention evaluated against whichever gambling, consumer, AML or AI rule set actually applies, per event.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, the kind of record an operator needs to show a regulator when each harm flag was raised and acted on.
Measures what player-risk models catch and miss, how quickly alerts reach a person, and whether interventions follow, against the indicators each regulator requires.
Detects bonuses, odds, limits and in-game offers that vary with signs of vulnerability, the line drawn by the EU AI Act and by Connecticut and New York.
Ongoing evaluation of self-exclusion matching, facial recognition and age checks for missed matches and error-rate skew across player groups.
Alert logic, thresholds, dispositions and model versions recorded for transaction monitoring and betting-integrity systems.
A compliance-state change on one brand, license or market propagates network-wide as it happens.
AxiSentinel can run alongside cloud gaming platforms, on-premises casino systems and in-region environments, or fully air-gapped.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it, not for a harm-detection model and not for a loot box.
Every licensed market sets its own thresholds, from UK stake limits to German deposit limits and Dutch and New Jersey triggers. Evidence is mapped to each license a player is served under.
The same architecture monitoring a bank’s credit model or a hospital’s diagnostic AI now monitors a player-risk model or a bonus engine. What changes is which RegDef packages are switched on.
Whether it’s a single sportsbook’s harm-detection model or a global operator’s full player stack, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
AxiSentinel finds and controls AI agents, with continuous compliance evaluation, for advertisers, agencies, ad tech platforms, publishers, broadcasters and newsrooms: the AI that generates the creative, clones the voice, picks the audience, scores brand safety, measures the campaign and drafts the story, evaluated against the AI, copyright, advertising, privacy and media rules of every market the ad runs in and the story reaches. EU AI Act deepfake labeling has applied since 2 August 2026, backed by a Commission code of practice published on 10 June 2026.
Advertising and media were among the first industries to put generative AI to everyday use: the image in the banner, the voice in the spot, the audience segment, the brand-safety score and the first draft of the story. Until recently none of it was regulated as AI. In 2025 and 2026 labeling law, copyright courts, targeting rules and media law all arrived at once.
Creative tools, ad platforms and measurement vendors each report on their own systems. AxiSentinel evaluates the whole chain, from training data to the published asset to the impression served, with evidence a regulator, a court or a client would accept.
Advertising and media AI sits under AI law, copyright law, advertising and consumer law, privacy law and media law, in every market a campaign runs and a story reaches. AxiSentinel tracks every layer and builds RegDef packages the moment a rule is stable enough to evaluate against.
The first horizontal AI law reaches the generative models agencies and newsrooms build on, and the content they publish in the EU.
Every online platform that shows ads must tell users, for each ad, that it is an ad, on whose behalf it runs, who paid and the main targeting parameters.
Fully applicable since 10 Oct 2025 to sponsors, publishers and providers of political advertising services.
Applies since 8 Aug 2025 to media service providers reaching EU audiences and to the very large platforms that carry their content.
Audience modeling, lookalikes and programmatic bidding all process personal data, and Europe’s courts have tested the consent framework the industry runs on.
Article 4 of the DSM Copyright Directive allows commercial text and data mining unless rightsholders reserve their rights in a machine-readable way.
Fair use is being decided case by case, and the outcomes now carry a price.
The FTC applies existing deception law to AI claims, AI-made endorsements and AI-generated reviews.
States regulate the voices, faces and provenance data that generative advertising depends on, while a federal digital-replica bill stalled in the Senate on 30 Sep 2026.
Two European markets outside the AI Act’s labeling rules are setting their own lines for AI in ads and synthetic likeness.
Asia’s largest advertising markets already require AI-generated content to be labeled.
General-purpose AI risk-management frameworks that already apply to every AI component in an agency, ad tech or newsroom stack.
From a single brand’s generative creative to a global publisher’s full editorial and ad stack, AxiSentinel evaluates advertising and media AI against whichever rule actually applies, wherever the audience, the content and the data sit.
Advertisers and platforms use AI to decide who sees an ad, at what price and next to what content. Rules on sensitive categories, minors and political advertising require those decisions to follow stated policies.
Ad systems run on personal data and AI-generated creative, both of which attackers abuse. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel’s core architecture changes for advertising and media. What changes is which RegDef packages are switched on and what telemetry the agents capture, from a creative generator to an ad server to a newsroom content system.
Agents capture generative-creative, ad-server, targeting, measurement and editorial-system telemetry on the cadence you configure, Always On or scheduled, never limited to a periodic audit cycle.
Every ad served, asset generated and story published evaluated against whichever AI, copyright, advertising, privacy or media rule set actually applies, per event.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, the kind of record a brand or publisher needs to show how each asset was made, labeled and placed.
Checks that visible labels and machine-readable marks are applied where the law requires them and still present when the content reaches the viewer.
Captures which datasets, licenses, rights reservations and consents sit behind each model and each generated asset, the question copyright courts now turn on.
Detects profiling-based delivery to minors, special-category audience segments and political targeting without explicit consent.
Links every cloned voice, digital double and synthetic performer to its consent, license scope and disclosure, campaign by campaign.
A compliance-state change on one brand, campaign or title propagates network-wide as it happens.
AxiSentinel can run alongside cloud ad platforms, on-premises newsroom and broadcast systems and in-region environments, or fully air-gapped.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it, not for a targeting model and not for a synthetic spokesperson.
Ongoing evaluation of brand-safety classifiers, attribution models and audience-measurement methods for accuracy, drift and skew.
The same architecture monitoring a bank’s credit model or a hospital’s diagnostic AI now monitors a creative generator or a newsroom summariser. What changes is which RegDef packages are switched on.
Whether it’s a single brand’s generative creative or a global publisher’s full ad and editorial stack, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
AxiSentinel finds and controls AI agents, with continuous compliance evaluation, for police forces, prosecutors, corrections agencies, emergency services, border and immigration authorities and the vendors that sell them AI: the face search that produces an investigative lead, the tool that drafts the police report, the model that triages the emergency call and the rules that screen a traveler, evaluated against the AI, data protection, criminal procedure and human rights rules that govern each use, with evidence that can stand up in court.
Police, emergency and border agencies adopted AI quickly: the face search that suggests a suspect, the tool that turns body-camera audio into a report, the model that ranks an emergency call, the rules that flag a traveler. For years few rules addressed it as AI. Between 2024 and 2027 settlements, state laws, federal policy and the EU AI Act all began asking for proof of how each output was produced.
Biometric, body-camera, records and dispatch vendors each report on their own tools. AxiSentinel evaluates the whole stack against the rules that govern each use, with evidence a court, an inspectorate or a defense attorney would accept.
Public safety AI sits under AI-specific law, police data protection law, criminal procedure, state statutes and human rights obligations, in every jurisdiction an agency operates in. AxiSentinel tracks every layer and builds RegDef packages the moment a rule is stable enough to evaluate against.
The first horizontal AI law sets its strictest limits on policing and its broadest high-risk category on law enforcement, migration and border AI.
Public authorities deploying high-risk AI must assess its effect on fundamental rights before first use, and register law enforcement and border systems in a restricted section of the EU database.
The data protection law for police and criminal justice processing, applying to every AI system that handles personal data for criminal investigation or prosecution.
In force since 25 Apr 2024, extending automated cross-border police data exchange to facial images and police records alongside DNA, fingerprints and vehicle data.
The first binding international AI treaty, opened for signature on 5 Sep 2024 and signed by the EU, the UK, the US and others.
The Court of Appeal held South Wales Police’s live facial recognition unlawful in 2020, in part because the force never verified whether the software was biased by race or sex.
Federal rules for agency AI and for every system that touches criminal justice information.
The first state laws on generative AI in police reporting, in force in Utah since 7 May 2025 and in California since 1 Jan 2026.
Statute and settlement now set enforceable rules for how a face-recognition lead may be used in an investigation.
General-purpose AI risk-management frameworks that apply to every AI component in a public safety stack, alongside the benchmark NIST uses to measure face-recognition accuracy.
From a single department’s report-drafting tool to a national border authority’s screening system, AxiSentinel evaluates public safety AI against whichever rule actually applies, with evidence that holds up when the output is challenged.
Agencies use AI to support dispatch, investigations, border screening and resource deployment. Decisions that affect rights and safety need a rationale, fairness testing and a named human decision-maker.
Public safety AI touches criminal justice data and evidence, where integrity and access control are non-negotiable. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel’s core architecture changes for public safety. What changes is which RegDef packages are switched on and what telemetry the agents capture, from a face-search console to an emergency call-triage model.
Agents capture face-search, video-analytics, report-drafting and call-triage telemetry on the cadence you configure, Always On or scheduled, never limited to a periodic audit cycle.
Every search, alert, report and screening decision evaluated against whichever AI, data protection or criminal procedure rule set actually applies, per event.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, the kind of record a prosecutor, a defense attorney or a court needs to see how an AI output was really produced.
Links each biometric deployment or retrospective search to its authorization, offense, time window and rights impact assessment, and flags any use without one.
Ongoing evaluation of face-recognition, document-fraud and risk-assessment models for error-rate skew across demographic groups.
Preserves first drafts, disclosure markers and officer certifications for AI-assisted reports, and compares them with the source footage.
Exports the systems, databases, model versions and human decisions behind an AI-assisted investigative step, ready for disclosure.
A compliance-state change on one system, unit or agency propagates across the whole deployment as it happens.
AxiSentinel can run alongside CJIS-aligned cloud services, on-premises agency systems and in-region environments, or fully air-gapped.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it, not for a face search and not for a border screening rule.
Evidence generated and held within the agency’s own jurisdiction and security boundary, so sensitive operational data never leaves the environment it belongs to.
The same architecture monitoring a bank’s credit model or a hospital’s diagnostic AI now monitors a face-recognition search or an emergency call-triage model. What changes is which RegDef packages are switched on.
Whether it’s a single department’s report-drafting tool or a national border authority’s screening system, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
AxiSentinel finds and controls AI agents, with continuous compliance evaluation, for growers, agribusinesses, machinery makers, drone operators, agri-input companies, commodity traders and the lenders and insurers who finance the farm: the AI that steers the autonomous tractor, flies the spray drone, diagnoses the crop, recommends the fertilizer rate, proves a shipment is deforestation-free and scores the farmer’s loan, evaluated against the machinery, drone, data, supply-chain and AI rules of every market the crop is grown in and sold to. The EU Deforestation Regulation applies from 30 December 2026 and the EU Machinery Regulation from 20 January 2027.
Farming has quietly handed a growing share of its decisions to AI: tractors that steer themselves, drones that spray, models that diagnose a crop from a photo and recommend the fertilizer rate, satellites that check the field against the subsidy claim. Until recently none of it was regulated as AI. Between 2024 and 2028 machinery law, drone law, data law, deforestation law and the EU AI Act all reach the farm gate.
Machinery makers, drone vendors, analytics platforms and traceability providers each report on their own systems. AxiSentinel evaluates the whole stack, from the machine in the field to the commodity at the border, with evidence a regulator, a buyer or a lender would accept.
Agricultural AI sits under machinery safety law, drone law, data law, supply-chain law, credit law and AI-specific law, in every market a crop is grown in and sold to. AxiSentinel tracks every layer and builds RegDef packages the moment a rule is stable enough to evaluate against.
The first horizontal AI law, applying in phases to AI a farm business deploys toward workers and borrowers and to AI built into the machines it sells, as amended by the AI Omnibus, Regulation (EU) 2026/1744.
Replaces the Machinery Directive from 20 Jan 2027 with no transition period, and writes autonomous mobile machinery and machine learning into EU machinery safety law for the first time.
Published July 2024, replacing ISO 18497:2018, it sets safety design principles for partially automated, semi-autonomous and autonomous tractors and agricultural machinery.
Applies from 30 Dec 2026 to large and medium operators and from 30 Jun 2027 to micro and small operators. The Commission’s May 2026 simplification review left these timelines unchanged.
Applies since 12 Sep 2025 to connected products, agricultural vehicles and machinery included, and the related services that run on their data.
Every Member State has had to run an area monitoring system since 1 Jan 2024, using Copernicus Sentinel satellite data to observe agricultural activity on every declared parcel.
Spray drones sit under two regimes: EU drone rules and the Sustainable Use of Pesticides Directive, which bans aerial spraying except by national derogation.
Commercial drone pilots need a Part 107 certificate, and dispensing pesticides, fertilizer or seed from a drone is an agricultural aircraft operation under Part 137.
Federal fair-lending law covers business credit, expressly including credit for agricultural purposes, whether the lender is a bank, a Farm Credit institution or a fintech.
Approved in Sep 2024 with an outlay of Rs 2,817 crore, the mission builds AgriStack: a farmers’ registry, geo-referenced village maps and a crop-sown registry, alongside a Krishi Decision Support System.
General-purpose AI risk-management frameworks that already apply to every AI component on the farm, in the machine and across the supply chain.
From a single grower’s spray drone to a global trader’s full sourcing network, AxiSentinel evaluates agricultural AI against whichever rule actually applies, wherever the field, the machine and the data sit.
Growers, cooperatives and agribusinesses use AI to plan planting, inputs and sourcing. Decisions that affect food supply, land and livelihoods need a record that buyers and lenders can rely on.
Farm equipment, food supply and yield models now rely on AI and connectivity, which attackers can reach. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel’s core architecture changes for agriculture. What changes is which RegDef packages are switched on and what telemetry the agents capture, from an autonomous tractor’s safety controller to a deforestation classifier.
Agents capture autonomous-machine, drone, sensor, satellite-analytics and traceability telemetry on the cadence you configure, Always On or scheduled, never limited to a periodic audit cycle.
Every machine decision, recommendation and credit or traceability outcome evaluated against whichever machinery, drone, supply-chain or AI rule set actually applies, per event.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, the kind of record a grower or trader needs to show how a field was treated or where a commodity came from.
Captures obstacle detection, working-area compliance, supervisor interventions and safety-decision logs for autonomous tractors, harvesters and farm robots.
Records the plot geolocation, imagery and land-cover model output behind each EUDR due diligence statement, so the evidence travels with the shipment.
Tracks the data, model version and outcome behind every variable-rate, seed and crop-protection recommendation, so agronomic claims can be backed up.
Ongoing evaluation of credit, crop-insurance and parametric models for outcome skew across regions, farm sizes and grower groups.
A compliance-state change on one machine, fleet, supplier or region propagates network-wide as it happens.
AxiSentinel can run alongside cloud farm-management platforms, on-premises systems and in-region environments, or fully air-gapped for fields and machines with intermittent connectivity.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it, not for an autonomous tractor and not for a farm-credit score.
Evidence generated and stored in the region where the farm data originates, to satisfy GDPR, India’s DPDP Act and every other regime a global agribusiness or commodity trader operates under.
The same architecture monitoring a bank’s credit model or a hospital’s diagnostic AI now monitors an autonomous tractor or a deforestation classifier. What changes is which RegDef packages are switched on.
Whether it’s a single autonomous tractor or a global trader’s full sourcing network, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
AxiSentinel finds and controls AI agents, with continuous compliance evaluation, for mining companies, critical-minerals developers and upstream oil and gas operators: the AI that drives the haul truck, stops it before a collision, watches the operator for fatigue, times the blast, targets the drill hole, estimates the resource, sorts the ore and warns of movement in a tailings dam, evaluated against the mine-safety, product-safety, disclosure, due-diligence, emissions and AI rules of every jurisdiction where the material is mined, processed and sold.
Mining was automating long before most industries: driverless haul trucks, autonomous drills, grade models and satellite monitoring of slopes and dams. Until recently none of it was regulated as AI. Between 2024 and 2027, product-safety law, supply-chain law, emissions law and the EU AI Act all reach the pit, the plant and the tailings facility at once.
Equipment makers, autonomy vendors and geoscience software providers each report on their own systems. AxiSentinel evaluates the whole stack, from the haul fleet to the tailings dam to the battery passport, with evidence a mine-safety regulator, a securities regulator or a battery maker would accept.
Mining and upstream AI sits under mine-safety law, product-safety law, securities disclosure, supply-chain due diligence, emissions law and AI-specific law, in every jurisdiction where the material is mined, processed and sold. AxiSentinel tracks every layer and builds RegDef packages the moment a rule is stable enough to evaluate against.
The first horizontal AI law, applying in phases to the AI a mine, a processing plant or an upstream operator deploys toward its workforce and its operations in the EU.
Replaces the Machinery Directive from 20 Jan 2027 and is the first EU product-safety law written with machine learning and autonomous mobile machinery in mind.
Launched in August 2020 and adopted by ICMM members, with conformance due by August 2023 for extreme and very high consequence facilities and by August 2025 for all others.
Every public estimate of a mineral resource or reserve must rest on the work of a named professional: a Competent Person under JORC, a Qualified Person under NI 43-101 and S-K 1300.
Western Australia’s code of practice for autonomous mining, issued in 2015 and carried forward under the Work Health and Safety Act 2020, sits alongside ISO 17757:2019, the international safety standard for autonomous and semi-autonomous earth-moving and mining machines.
Since 17 Jul 2024, surface mines must keep a written safety program for surface mobile equipment, reviewed at least once a year.
In force since 23 May 2024 (Regulation (EU) 2024/1252), with 60 strategic projects selected inside and outside the EU in 2025.
Mine-to-market traceability is becoming law for the minerals that go into batteries and electronics.
The Omnibus I directive was published on 26 Feb 2026 and entered into force on 18 Mar 2026, narrowing both laws to the largest companies.
In force since 4 Aug 2024 for oil, gas and coal producers and for importers of those fuels.
Operators of oil production, refining and treatment facilities are listed among the sectors of high criticality.
General-purpose AI risk-management frameworks that already apply to every AI component in a mine, a processing plant or an oilfield.
From a single autonomous haul fleet to a global miner’s full operating and supply-chain stack, AxiSentinel evaluates mining AI against whichever rule actually applies, wherever the site, the operations center and the data sit.
Mining companies use AI to support exploration targets, mine plans and equipment investments. Decisions with safety, environmental and community effects need a rationale that boards and regulators can follow.
Autonomous haulage and remote operations make mine safety depend on secure AI and networks. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel’s core architecture changes for mining. What changes is which RegDef packages are switched on and what telemetry the agents capture, from an autonomous haul truck to a tailings piezometer.
Agents capture autonomy-system, collision-avoidance, process-control and geotechnical telemetry on the cadence you configure, Always On or scheduled, never limited to a periodic audit cycle.
Every autonomous stop, sensor alert and model output evaluated against whichever mine-safety, product-safety, emissions or AI rule set actually applies, per event.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, the kind of record a mine needs to show what its autonomous fleet and monitoring systems really did.
Ties every autonomy software and configuration change to its approval, acceptance test and post-change performance, across every truck, drill and dozer.
Tests the models that watch piezometers, survey prisms and satellite radar for missed signals and alert drift, and records every alert and response.
Ongoing evaluation of collision-avoidance, fatigue, proximity and methane-detection models for missed detections and false alarms across conditions and crews.
Captures the data, versions and validation behind machine-learning grade and resource models, the evidence a Competent Person or Qualified Person needs before signing.
A compliance-state change on one site, fleet or facility propagates network-wide as it happens.
AxiSentinel can run at the mine site, in the remote operations center, in the cloud or in-region, or fully air-gapped for sites with limited connectivity.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it, not for a haul truck and not for a tailings dam.
Signed provenance for origin, processing and emissions data as it moves from the pit to the smelter, the battery passport and the sustainability report.
The same architecture monitoring a bank’s credit model or a hospital’s diagnostic AI now monitors an autonomous haul fleet or a tailings early-warning system. What changes is which RegDef packages are switched on.
Whether it’s a single autonomous fleet or a global miner’s full operating stack, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
AxiSentinel finds and controls AI agents, with continuous compliance evaluation, for contractors, engineering and architecture firms, construction technology vendors and building owners: the AI that generates the design, checks it against the code, watches the site for missing hard hats, drives the autonomous machine, prices the bid, predicts the schedule slip and models the building’s energy use, evaluated against the product-safety, building-safety, occupational-safety, privacy and AI rules of every market the project is built in. Singapore’s CORENET X model-based submissions have been mandatory for new projects of 5,000 m² and above since 1 October 2026.
Construction has adopted AI faster than its rules have named it: the design option a tool generates, the code check it passes, the camera that flags a missing harness, the excavator that digs on its own, the estimate behind the bid. Between 2025 and 2027 product law, building-safety law, liability law and the EU AI Act all reach the site at once.
Design-software, site-safety and equipment vendors each report on their own tools. AxiSentinel evaluates the whole project stack, from model to machine, with evidence a building regulator, a court or an insurer would accept.
Construction AI sits under product law, building-safety law, occupational-safety law, privacy law and AI-specific law, in every market a project is built in. AxiSentinel tracks every layer and builds RegDef packages the moment a rule is stable enough to evaluate against.
The first horizontal AI law, applying in phases to the AI a contractor, designer or equipment maker deploys on EU projects.
Replaces the Machinery Directive from 20 Jan 2027 with no transition period, covering excavators, cranes, site robots and other construction machinery.
In force since 7 Jan 2025 and applicable since 8 Jan 2026, with parts of the old regulation running alongside it until 8 Jan 2040.
In force since 28 May 2024, with national transposition due by 29 May 2026.
Brings software and AI expressly within strict product liability, with national transposition due by 9 Dec 2026.
Site cameras, wearables, biometric gate access and equipment telematics all process workers’ personal data.
Higher-risk buildings of 18 metres or seven storeys and above pass Building Safety Regulator gateways before work starts and before occupation.
Federal construction safety rules apply whether hazards are spotted by a supervisor or a camera, and state biometric law reaches site time clocks.
Engineering boards are setting out what responsible charge means when AI produces calculations and drawings.
The international series for managing information across the life of buildings and civil engineering works using BIM.
The markets that mandated digital submissions first are where AI code-checking meets the regulator directly.
General-purpose AI risk-management frameworks that already apply to every AI component in a contractor, designer or equipment stack.
From a single contractor’s site cameras to a global engineering firm’s design stack, AxiSentinel evaluates construction AI against whichever rule actually applies, wherever the project, the firm and the data sit.
Builders and owners use AI to compare designs, price bids and plan schedules. Each decision with safety and cost consequences needs a rationale that owners, insurers and inspectors can follow.
Construction now runs on shared digital models, autonomous equipment and large payments, all of which attract attackers. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel’s core architecture changes for construction. What changes is which RegDef packages are switched on and what telemetry the agents capture, from a generative design tool to an autonomous excavator.
Agents capture site-camera, BIM, design-tool, scheduling and machine telemetry on the cadence you configure, Always On or scheduled, never limited to a periodic audit cycle.
Every safety alert, design check, model change and machine decision evaluated against whichever building, safety, product or AI rule set actually applies, per event.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, the kind of record a golden thread or a liability claim needs to show what the AI did and when.
Tracks AI-generated designs and automated code checks against verification results, so a firm can show a licensed professional reviewed the output before it was sealed.
Ongoing evaluation of PPE, exclusion-zone and hazard-detection models for missed alerts and error-rate skew, with checks that no emotion inference is running.
Captures safety-related decisions, supervisor interventions and stop events from autonomous equipment and site robots, as the Machinery Regulation expects.
Hashes model versions, approval states and change records so the information handed to the building owner can be shown to be complete and unaltered.
A compliance-state change on one site, model or machine propagates across the project and the portfolio as it happens.
AxiSentinel can run alongside cloud BIM and project platforms, site edge devices and in-region environments, or fully air-gapped.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it, not for a design generator and not for a site camera.
Preserves the data and model runs behind construction product declarations, energy certificates and life-cycle carbon figures, for the CPR and the EPBD.
The same architecture monitoring a bank’s credit model or a hospital’s diagnostic AI now monitors a generative design tool or a site-safety camera. What changes is which RegDef packages are switched on.
Whether it’s a single contractor’s site cameras or a global firm’s full design and delivery stack, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
AxiSentinel finds and controls AI agents, with continuous compliance evaluation, for satellite operators, Earth observation data and analytics firms, launch providers, satellite communications networks and the ground segment: the AI that screens conjunctions and plans the avoidance maneuvere, watches spacecraft health on board, classifies radar and optical imagery, and turns pixels into findings that governments, insurers, lenders and traders rely on, evaluated against the licensing, debris, cyber, export-control and AI rules of every jurisdiction the operator licenses in and sells to.
Satellite operators were early to hand decisions to software: when to maneuvere, what the spacecraft is doing wrong, what changed on the ground below. For years the only rules that mattered were the license and the frequency filing. Between 2024 and 2026 debris deadlines, ground-segment cyber law, export rules, the EU AI Act and a proposed EU Space Act all arrived at the mission-control console at once.
Flight-software, conjunction-screening and analytics vendors each report on their own tools. AxiSentinel evaluates the whole stack, across every jurisdiction an operator licenses in and sells to, with evidence a regulator, an insurer or a buyer of analytics would accept.
Space AI sits under licensing and debris rules, cyber law, export controls and AI-specific law, in every jurisdiction an operator licenses in, downlinks to and sells data into. AxiSentinel tracks every layer and builds RegDef packages the moment a rule is stable enough to evaluate against.
Applies to satellite and Earth observation AI placed on the EU market or used in the EU. Systems used exclusively for military, defense or national security purposes are outside its scope; dual-use systems sold commercially are not.
Proposed by the Commission on 25 Jun 2025 and under negotiation in the Council and Parliament through 2026. As proposed, it would apply from 1 Jan 2030 to EU operators and to non-EU operators providing space data or services in the EU.
Space is a sector of high criticality under Annex I: operators of ground-based infrastructure that support the provision of space-based services are in scope, with national laws transposed from 17 Oct 2024.
Applies from 30 Dec 2026 to large and medium operators, and from 30 Jun 2027 to most micro and small enterprises, with plot-level geolocation at the core of due diligence.
The FCC licenses US satellites and grants market access to non-US systems serving the US.
Private remote sensing space systems need a Commerce Department license under 15 CFR Part 960, as rewritten in a rule effective 20 Jul 2020.
Spacecraft, remote sensing technology and related technical data are among the most tightly controlled exports, and models and training data can be technical data too.
Launch and orbital activities carried out from the UK are licensed under the Space Industry Act 2018, with the UK CAA as regulator.
Japan licenses launches and satellite control under the Space Activities Act and regulates Earth observation under a separate remote sensing law, both from 2016.
The international layer every national license draws on, part treaty, part standard, part voluntary commitment.
General-purpose AI risk-management frameworks that already apply to every AI component in a satellite, ground or analytics stack.
From a single Earth observation analytics product to a full constellation with its ground network, AxiSentinel evaluates space AI against whichever rule actually applies, wherever the spacecraft, the ground station and the data sit.
Space programs use AI to compare mission architectures, payloads and launch options. Long-horizon decisions need a record that survives reviews, changes in team and changes in the program.
Satellites, ground stations and onboard autonomy are targets for states and criminals alike. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel’s core architecture changes for space. What changes is which RegDef packages are switched on and what telemetry the agents capture, from a conjunction-screening service to an imagery analytics pipeline.
Agents capture conjunction-screening, flight-software, ground-segment and Earth observation analytics telemetry on the cadence you configure, Always On or scheduled, never limited to a periodic audit cycle.
Every maneuvere decision, analytic output and ground-system event evaluated against whichever licensing, debris, cyber, export or AI rule set actually applies, per event.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, the kind of record an operator needs to show how each avoidance decision was really made.
Captures the conjunction data, probability estimate, model version and approval behind every avoidance maneuvere, and every decision not to maneuvere.
Ongoing evaluation of change-detection, object-detection and radar classification models for error-rate skew across regions, seasons and sensors.
Tracks where imagery, training data and model weights came from and where they went, with screening records for ITAR, EAR and EU dual-use controls.
End-of-life plans, ephemeris sharing and disposal timelines tracked against the FCC five-year rule, ISO 24113 and any Zero Debris Charter commitments.
A compliance-state change on one satellite, ground station or analytics product propagates fleet-wide as it happens.
AxiSentinel can run alongside mission control, ground stations, cloud processing pipelines and in-region environments, or fully air-gapped for sensitive and export-controlled programs.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it, not for a collision-avoidance model and not for an analytic sold as evidence.
Detection coverage, incident-handling and supplier-risk evidence for ground stations and mission control, mapped to NIS2 and the cybersecurity chapter of the proposed EU Space Act.
The same architecture monitoring a bank’s credit model or a hospital’s diagnostic AI now monitors a conjunction-assessment model or an Earth observation change-detection pipeline. What changes is which RegDef packages are switched on.
Whether it’s a single analytics product or a full constellation with its ground network, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
AxiSentinel finds and controls AI agents, with continuous compliance evaluation, for smart speakers and voice assistants, connected cameras and doorbells, smart TVs, connected appliances, robot vacuums and home robots, AI toys and in-car infotainment: the AI that hears the wake word, recognizes a face at the door, maps the living room, talks to a child and updates itself overnight, evaluated against the product-security, product-safety, data-access, privacy, child-protection and AI rules of every market the device is sold into. Cyber Resilience Act reporting has applied since 11 September 2026, the Data Act design duty since 12 September 2026, and California’s moratorium on companion-chatbot toys starts on 1 January 2027.
Consumer devices were among the first products to put AI in the room with people: the assistant that wakes on a word, the camera that decides who is at the door, the robot that maps the floor plan, the toy that talks back. For years they were regulated as electronics. Between 2024 and 2028 product-security law, data-access law, child-privacy law and the EU AI Act all arrive in the living room.
Device makers test at launch, chipset and cloud vendors report on their own components, and security labels check a product once. AxiSentinel evaluates the AI across the whole fleet after every update, in every market, with evidence a regulator, a court or a retailer would accept.
Consumer IoT sits under product-security law, product-safety law, data-access law, privacy and child-protection law and AI-specific law, in every market a device is sold into. AxiSentinel tracks every layer and builds RegDef packages the moment a rule is stable enough to evaluate against.
Regulation (EU) 2024/2847 sets horizontal cybersecurity rules for every product with digital elements, and singles out smart home assistants, security cameras, door locks, baby monitors and connected toys as important products.
Delegated Regulation (EU) 2022/30 has applied since 1 Aug 2025 to internet-connected radio equipment, which covers almost every Wi-Fi, Bluetooth or cellular device in the home.
Regulation (EU) 2023/2854 has applied since 12 Sep 2025 and gives users of connected products and related services a right to the data their devices generate.
Applies in phases to AI placed on the EU market inside consumer devices, from the voice assistant in the kitchen to the chatbot in a child’s toy.
Voice recordings, camera footage, home maps and usage logs are personal data, and voiceprints and faceprints used to identify someone are special-category data.
The GPSR has applied since 13 Dec 2024 and requires the safety assessment of a consumer product to account for cybersecurity and for evolving, learning and predictive functions.
The UK product security regime has applied since 29 Apr 2024 to consumer connectable products, enforced by the Office for Product Safety and Standards.
The FTC treats retained voice and video data, and the models trained on it, as an enforcement target.
California regulates both how connected devices are secured and, from 2027, whether a children’s toy may contain a companion chatbot at all.
Security labels are becoming the evidence buyers and retailers look for on the box, most of them built on the ETSI EN 303 645 consumer IoT baseline published in 2020.
General-purpose AI risk-management frameworks that already apply to every AI component in a device, its companion app and its cloud.
From a single smart camera model to a global fleet of speakers, TVs and robots, AxiSentinel evaluates consumer device AI against whichever rule actually applies, wherever the device, the user and the data sit.
Smart home devices use AI to decide what to record, who to recognize and when to act. Consumer protection, privacy and child safety rules expect those decisions to be predictable and to respect every person in the home.
Smart devices bring AI assistants into homes, where a takeover reaches people’s private lives. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel’s core architecture changes for consumer IoT. What changes is which RegDef packages are switched on and what telemetry the agents capture, from a wake-word model to a firmware update server.
Agents capture device-fleet, firmware-update, companion-app and cloud AI telemetry on the cadence you configure, Always On or scheduled, never limited to a periodic audit cycle.
Every model update, data request and device interaction evaluated against whichever product-security, privacy, child-protection or AI rule set actually applies, per event.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, the kind of record a manufacturer needs to show what a device collected, kept and deleted.
Links each over-the-air update and AI model version to its software bill of materials and support-period commitment, the record the Cyber Resilience Act now demands.
Tracks retention, deletion, human review and training use of recordings, footage and home maps, the questions behind the FTC’s Alexa and Ring actions.
Ongoing evaluation of false activations, missed detections and face-match error rates across accents, ages and skin tones.
Output testing and escalation evidence for toy chatbots and voice assistants used by children, mapped to age-exploitation and toy-safety rules.
A compliance-state change on one product line, model version or market propagates fleet-wide as it happens.
AxiSentinel can run alongside device clouds, manufacturing test lines and in-region environments, or fully air-gapped.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it, not for a wake-word model and not for a child’s talking toy.
Captures detection, triage and notification timestamps so a manufacturer can show it met the CRA’s 24-hour early-warning clock.
The same architecture monitoring a bank’s credit model or a hospital’s diagnostic AI now monitors a smart speaker or a robot vacuum fleet. What changes is which RegDef packages are switched on.
Whether it’s a single camera model or a global device fleet, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
AxiSentinel finds and controls AI agents, with continuous compliance evaluation, for smartwatches and fitness trackers, health and wellness apps, connected gym equipment, professional clubs and leagues, and the broadcasters and platforms around them: the AI that turns a pulse into a sleep score, estimates blood pressure from a wrist sensor, coaches a runner, predicts an athlete’s injury risk, draws the offside line and cuts the highlight reel, evaluated against the medical-device, health-data, consumer, employment and AI rules of every market the device ships to and every league the athlete plays in.
Wearables and sport were among the first places AI met the human body in everyday life: the readiness score on the wrist, the blood pressure estimate, the coaching plan, the injury-risk flag, the offside line on the broadcast. Most of it was treated as wellness or entertainment. In 2025 and 2026 medical-device regulators, health-data law, the EU Data Act and the EU AI Act all arrived at the same time.
Device makers, app developers, data providers and officiating vendors each report on their own systems. AxiSentinel evaluates the whole stack, from sensor to score to decision, with evidence a regulator, a court, a players’ union or a league would accept.
Wearable and sports AI sits under medical-device law, health-data and consumer law, employment and data-protection law for athletes, sporting rules and AI-specific law, in every market a device ships to and every league an athlete plays in. AxiSentinel tracks every layer and builds RegDef packages the moment a rule is stable enough to evaluate against.
The first horizontal AI law, applying in phases to every AI system a device maker, app developer, club or broadcaster places on the EU market or uses on EU athletes and users.
Software with a medical intended purpose is a medical device under the MDR, and the line between a wellness feature and a diagnostic one is drawn by what the manufacturer claims and builds.
Heart rate, sleep, cycle and injury data are data concerning health, a special category under Article 9 that needs an explicit legal basis such as explicit consent.
Applies from 12 Sep 2025 to connected products and related services, from a smartwatch to a connected rowing machine and the health-tracking service behind it.
Regulation (EU) 2025/327 entered into force on 26 Mar 2025 and applies in stages through 2031.
The FDA revised its general wellness guidance on 6 Jan 2026, six months after warning a fitness-wearable maker that blood pressure estimates made its feature a device.
Amended rule in force since 29 Jul 2024, expressly covering health apps and connected devices that sit outside HIPAA.
Washington’s My Health My Data Act and Nevada SB 370 apply since 31 Mar 2024, and Connecticut’s consumer health data rules since 1 Jul 2023.
AI and optical tracking now draw the lines that decide matches, while the rules keep a human official responsible for the final call.
Player unions, collective agreements and data-protection claims are setting the terms on which athlete data can be collected, used and sold.
General-purpose AI risk-management frameworks that already apply to every AI component in a wearable, app, club or broadcast stack.
From a single app’s sleep score to a league’s full officiating and player-data stack, AxiSentinel evaluates sports and wearable AI against whichever rule actually applies, wherever the user, the athlete and the data sit.
Wearables use AI to flag health signals, set goals and share data. Health data and consumer protection rules expect those decisions to be accurate, explainable and based on consent.
Wearables collect health and location data around the clock, often analyzed by AI in the cloud. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel’s core architecture changes for sports and wearables. What changes is which RegDef packages are switched on and what telemetry the agents capture, from a wrist sensor’s firmware to a stadium’s tracking cameras.
Agents capture wearable firmware, health-app, coaching-model, player-tracking and officiating-system telemetry on the cadence you configure, Always On or scheduled, never limited to a periodic audit cycle.
Every health metric, data share, coaching response and tracking decision evaluated against whichever device, health-data, consumer or AI rule set actually applies, per event.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, the kind of record a wearable maker needs to show what a feature claimed and how it was validated.
Monitors feature releases, in-app copy and notifications against FDA and EU MDR intended-use lines, flagging the moment a wellness feature starts to read like a diagnosis.
Maps every recipient of heart, sleep, cycle and location data to the consent and legal basis behind it, for GDPR, the FTC rule and US state health data laws.
Ongoing evaluation of heart-rate, SpO2, blood pressure and sleep models for error-rate skew across skin tones, body types, ages and activity levels.
Injury-risk, scouting and officiating models tracked for accuracy, drift and outages, with every human override and final call recorded.
A compliance-state change on one device line, app or venue propagates network-wide as it happens.
AxiSentinel can run alongside wearable cloud platforms, club and league systems and stadium infrastructure, or fully air-gapped.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it, not for a sleep score and not for an offside line.
Evidence generated and stored in the user’s or athlete’s region, to satisfy GDPR, UK GDPR, US state health data laws and every other regime a global brand or league operates under.
The same architecture monitoring a bank’s credit model or a hospital’s diagnostic AI now monitors a smartwatch health feature or a club’s injury-risk model. What changes is which RegDef packages are switched on.
Whether it’s a single app’s sleep score or a league’s full officiating and player-data stack, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
AxiSentinel finds and controls AI agents, with continuous compliance evaluation, for accounting and audit firms, tax advisers, consulting firms, actuaries and HR and recruitment agencies: the AI that tests a journal entry, drafts a workpaper or a tax memo, reviews a contract, screens a candidate and captures the billable hour, evaluated against the audit standards, ethics codes, confidentiality rules and AI laws that govern each engagement, with evidence a regulator, an inspector or a client can rely on. PCAOB QC 1000 takes effect on 15 December 2026.
Audit, tax, consulting and recruitment firms sell judgment, and AI now sits inside that judgment: the analytics that pick which entries to test, the assistant that drafts the memo, the model that ranks the candidates. Between 2022 and 2026 audit standard-setters, ethics boards, tax confidentiality rules, hiring laws and the EU AI Act all arrived at the engagement at once.
Audit, tax and recruitment software vendors each report on their own tools. AxiSentinel evaluates the whole firm’s AI stack, across every engagement and jurisdiction, with evidence an inspector, a regulator or a client would accept.
Professional services AI sits under audit and quality standards, ethics codes, confidentiality and privacy law, hiring law and AI-specific law, in every jurisdiction a firm and its clients operate in. AxiSentinel tracks every layer and builds RegDef packages the moment a rule is stable enough to evaluate against.
The standards that govern every audit of a US public company now speak directly to the technology auditors use to gather and evaluate evidence.
The global audit standard-setter’s quality management standard has applied since 15 Dec 2022, and its evidence standards are being rewritten for a digital environment.
In effect since 15 Dec 2024 for professional accountants in business and in public practice wherever the Code is adopted.
Released on 11 Sep 2026, the AICPA’s first technical guidance on how a service organization’s use of AI affects SOC reporting.
Applies in phases to every AI system a firm deploys toward clients, candidates or its own staff in the EU.
Client ledgers, payroll files and candidate records are personal data the moment they enter an AI tool.
Tax return preparers may not knowingly or recklessly disclose or use tax return information beyond what the regulations allow, and contractors who receive it are treated as preparers.
The sustainability reporting regime was scaled back by Directive (EU) 2026/470, in force since 18 Mar 2026, but assurance remains.
The hiring-AI laws that reach recruitment agencies and the firms’ own graduate and lateral hiring.
Audit regulators are setting expectations for AI in the engagement itself.
General-purpose AI risk-management frameworks that already apply to every AI tool in a firm’s audit, tax, advisory and recruitment stack.
From a single practice’s tax research assistant to a global network’s audit analytics, AxiSentinel evaluates professional services AI against whichever rule actually applies, wherever the firm, the client and the data sit.
Audit, tax, advisory and consulting firms use AI to analyze data and draft conclusions. Professional standards still require the professional to understand, check and own every judgment.
Firms hold client secrets and money flows, and staff adopt AI tools faster than policies keep up. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel’s core architecture changes for professional services. What changes is which RegDef packages are switched on and what telemetry the agents capture, from a journal-entry model to a candidate-screening tool.
Agents capture inputs, outputs, model versions and reviewer actions from audit analytics, tax engines, drafting assistants and screening tools on the cadence you configure, Always On or scheduled, never limited to a periodic inspection cycle.
Every flagged entry, drafted answer and screening decision evaluated against whichever audit, ethics, confidentiality or AI rule set actually applies, per event.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, the kind of record a firm needs to show an inspector how an AI-assisted conclusion was really reached.
Ties each AI output to the engagement, procedure and reviewer it supports, so quality reviewers and inspectors can trace a conclusion back to its evidence.
Checks drafted workpapers, tax memos and client deliverables for unsupported statements and fabricated citations before they are relied on.
Ongoing evaluation of candidate sourcing and screening models for selection-rate skew across protected groups.
Records which client and taxpayer data reached which AI tool and vendor, and under what consent, across every engagement.
A compliance-state change on one tool, office or service line propagates network-wide as it happens.
AxiSentinel can run alongside cloud audit and tax platforms, on-premises firm systems and in-region environments, or fully air-gapped.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it, not for an audit analytics tool and not for a candidate-screening model.
Supplies ISQM 1 and QC 1000 monitoring with continuous evidence on each AI tool, so deficiencies surface between inspections rather than during them.
The same architecture monitoring a bank’s credit model or a hospital’s diagnostic AI now monitors a journal-entry model or a tax research assistant. What changes is which RegDef packages are switched on.
Whether it’s a single practice’s tax research assistant or a global network’s audit analytics, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
AxiSentinel finds and controls AI agents, with continuous compliance evaluation, for the plants and formulation labs behind food and beverage manufacturing, food-contact packaging and can coatings: the AI systems increasingly used to optimize formulations, screen for food-contact and migration compliance, detect defects on the line, forecast demand, and run production and back-office systems, evaluated against the rules of the FDA, the EU's food-contact materials regime, ISO and every AI governance framework a plant actually operates under. PFAS limits under the EU Packaging and Packaging Waste Regulation have applied to food-contact packaging since 12 August 2026.
For decades, food-contact compliance was proven the same way: a fixed formulation, tested once against a migration limit, documented and left alone. AI breaks that model. Formulation-optimization tools now adjust can-coating recipes on the fly, vision models decide which parts fail inspection, and forecasting and planning AI drives decisions a regulator, a customer or an auditor can no longer simply re-derive from a lab report.
From a single can-coating formulation model to a plant's full production and inspection-readiness stack, AxiSentinel evaluates food-contact and industrial-materials AI against whichever standard actually applies, wherever the product ships.
Food, beverage and packaging producers use AI to predict migration results, inspect lines and plan production. Food safety and food-contact rules expect those decisions to rest on real test data and a clear rationale.
Food production uses AI in lines, safety checks and traceability, where integrity protects consumers. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel's core architecture changes for food-contact materials or beverage production. What changes is which RegDef packages are switched on and what telemetry the agents capture, from a formulation model to a can-line inspection camera.
Agents capture formulation-model, vision-inspection, process-control and planning telemetry on the cadence you configure, Always On or scheduled, never limited to a periodic audit cycle.
Every telemetry event evaluated against whichever food-contact, chemical-safety or AI-specific rule set actually applies, per event, per market.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, verifiable from the first event, built for the same scrutiny a food-safety inspector or a customer's technical auditor would apply.
Tracks how much human judgment sits behind an AI-assisted formulation, migration-prediction or defect-disposition decision, the exact question a technical buyer or regulator asks first.
Ongoing evaluation of can-lining and food-packaging inspection models for false-negative skew across product lines and production shifts.
Formulation and migration-prediction models checked against real lab test results, not the model's own training claims.
Carbon-footprint, Green Industry and certification-support claims traced back to the data and models that produced them.
A single formulation or inspection model evaluated against the food-contact and chemical rules of every market it ships into, not just its home market.
Whether it's a single formulation-optimization model or a plant's full production and inspection-readiness stack, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
AxiSentinel finds and controls AI agents, with continuous compliance evaluation, for the plants and formulation labs behind industrial and automotive coatings, coating and molding resins, and natural rubber and latex processing: the AI systems increasingly used to optimize formulations, screen for REACH and chemical-safety compliance, detect defects on the line, forecast demand, and run production and back-office systems, evaluated against the rules of REACH, ECHA, ISO and every AI governance framework a plant actually operates under. The EU Deforestation Regulation reaches natural rubber from 30 December 2026.
For decades, a coating or resin formulation was proven once in the lab and left alone. AI breaks that model. Formulation-optimization tools now adjust acrylic, polyester, alkyd and unsaturated polyester resin recipes on the fly, vision models decide which parts fail inspection on a coating or latex line, and planning AI drives raw-material and export decisions a regulator, lender or customer can no longer simply re-derive from a lab report.
From a single coating formulation model to a plant's full production and export-compliance stack, AxiSentinel evaluates coating, resin and rubber-manufacturing AI against whichever standard actually applies, wherever the product ships.
Coatings, resin and rubber makers use AI to adjust formulations, predict quality and decide what passes inspection. REACH, SVHC and customer specifications make each of those decisions one that may need to be shown to an auditor or a customer.
Chemical manufacturers use AI for formulation and process control, where both intellectual property and plant safety are at stake. AxiLayer AI works hand in hand with your security team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Agent Security Request a Discovery and Risk Assessment
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
Nothing about AxiSentinel's core architecture changes for coating, resin or rubber manufacturing. What changes is which RegDef packages are switched on and what telemetry the agents capture, from a formulation model to a glove inspection line.
Agents capture formulation-model, vision-inspection, process-control and planning telemetry on the cadence you configure, Always On or scheduled, never limited to a periodic audit cycle.
Every telemetry event evaluated against whichever REACH, chemical-safety or AI-specific rule set actually applies, per event, per market.
Every audit record is linked to the one before it in a signed, tamper-evident evidence chain, verifiable from the first event, built for the same scrutiny a chemical-safety regulator or a customer's technical auditor would apply.
Tracks how much human judgment sits behind an AI-assisted formulation, SVHC-declaration or defect-disposition decision, the exact question a technical buyer or regulator asks first.
Ongoing evaluation of coating, resin and rubber-product inspection models for false-negative skew across product lines and production shifts.
Formulation and declaration-support models checked against real lab test results and the current SVHC list, not the model's own training claims.
Carbon-footprint, Green Industry and certification-support claims traced back to the data and models that produced them.
A single formulation or inspection model evaluated against the chemical-safety and REACH-equivalent rules of every market it ships into, not just its home market.
Whether it's a single formulation-optimization model or a plant's full production and export-compliance stack, AxiSentinel evaluates it the same way it evaluates any AI system: on the cadence you configure, Always On or scheduled, with full evidence, and with a human signature before anything counts as a finding.
Comprehensive coverage of EU AI Act requirements, risk classifications, conformity assessment procedures, and implementation timelines, including the AI Omnibus dates: Annex III high-risk duties from 2 Dec 2027 and Annex I products from 2 Aug 2028.
A practitioner's guide to implementing the NIST AI Risk Management Framework across enterprise AI programs, and where U.S. state laws such as Texas TRAIGA give it legal weight.
Step-by-step guidance for establishing, implementing, maintaining, and continually improving an AI management system, mapped clause by clause to the EU AI Act and NIST AI RMF.
A comprehensive audit checklist covering all EU AI Act high-risk system requirements and documentation obligations, dated to the Omnibus timeline and cross-referenced to NIST AI RMF and ISO/IEC 42001.
Calculate potential EU AI Act fines (higher-of for undertakings, lower-of for SMEs), reputational costs, and operational savings from proactive AI compliance investments.
A 28-point checklist for clinical AI covering FDA AI-enabled device software guidance, HIPAA safeguards, and EU AI Act duties for AI in medical devices.
Maps the FS AI RMF to U.S. model risk guidance, the EU AI Act, and ISO/IEC 42001, with a board-ready readiness checklist.
Scope, data inventory, impact ratios, candidate notices, and publication steps for the annual bias audit of automated employment decision tools.
Federal risk-management expectations, state AI laws, employment rules, and sector obligations mapped into assessment-ready evidence.
Binding AI laws in China, South Korea, and Vietnam alongside the Japan, Singapore, India, Australia, and Hong Kong frameworks, in one regional view.
Aligning AI governance, risk, security, and privacy evidence across ISO, NIST, EU, U.S., and APAC expectations for multi-region programs.
220+ frameworks encoded and 940+ obligations across 66+ government jurisdictions in 43 countries, filterable by region and tagged binding, guidance, pending, or standard. We also track 201 AI audit mandates across 81 countries and 8 regions.
Short enforcement briefs updated for the in-force AI Omnibus: what changed, what it means for operators, and where to read the source.
Twenty-one questions across five areas return your result and the first steps to take.
Model the maximum regulatory exposure under the EU AI Act, NYC Local Law 144, and HIPAA before an audit scopes the real gaps.
AI use and governance policy for agencies, utilities, and municipalities, built on OMB M-25-21, Canada's DADM, and the EU and Asia-Pacific public sector rules.
Analysis and regulatory updates from the AxiLayer AI team, from CEO questions to what a real AI audit looks like from the inside.
Seventeen milestones across Europe, Asia, and North America that change what an AI audit must evidence. Swipe or scroll the rail; each date links to its source.
AI Act prohibitions and AI literacy duties apply
SourceGeneral-purpose AI model obligations apply
SourceMandatory labeling of AI-generated content
SourceCivil rights rules on automated decision systems in employment
SourceTexas TRAIGA, Illinois HB 3773, California SB 53 and SB 243 take effect
SourceAI Basic Act in force, with a grace period on fines
SourceIT Rules amendment: synthetic content labeling and three-hour takedowns
SourceLaw on Artificial Intelligence in force, risk-based duties
SourceSR 26-2 model risk guidance replaces SR 11-7
SourceArticle 50 transparency duties apply; Commission GPAI enforcement powers begin
SourceCyber Resilience Act vulnerability reporting starts
SourceNew prohibitions and Article 50(2) marking for systems already on the market
SourceProduct Liability Directive transposition: software and AI are products
SourceColorado SB 26-189 and California ADMT regulations apply
SourceLegacy general-purpose AI models must comply
SourceAnnex III high-risk obligations apply
SourceHigh-risk AI in Annex I regulated products
SourceStatus as of October 2026. Summary for orientation, not legal advice.
Regulators scope duties by use, not by technology. Pick the use case closest to yours to see the rules that apply and where to read next.
The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) entered into force on August 1, 2024, establishing the world's first comprehensive legal framework for artificial intelligence. The Act takes a risk-based approach, imposing obligations that scale with the potential harm an AI system could cause.
A conformity assessment is the formal process by which high-risk AI systems are evaluated against EU AI Act requirements before market placement. Most high-risk systems listed in Annex III use the provider's internal control under Article 43, and some biometric systems need a notified body. The assessment covers risk management systems, technical documentation (Annex IV), data governance, human oversight, accuracy, and cybersecurity measures.
The EU AI Act's stand-alone Annex III high-risk obligations apply from December 2, 2027, and high-risk AI embedded in Annex I product-regulated goods from August 2, 2028, following the AI Omnibus (Regulation (EU) 2026/1744), which entered into force on July 27, 2026. Organizations must complete conformity assessments, prepare Annex IV technical documentation, and register in the EU AI database before their applicable date. Article 50 transparency obligations were not deferred and have applied since August 2, 2026. GPAI model obligations applied from August 2, 2025, with Commission enforcement powers from August 2, 2026. Prohibited AI systems were banned from February 2, 2025.
Fines for placing prohibited AI systems on the market can reach €35 million or 7% of global annual turnover, whichever is higher. Violations of other high-risk system obligations carry fines of up to €15 million or 3% of global annual turnover. Providing incorrect information to notified bodies or national authorities can result in fines up to €7.5 million.
High-risk AI systems are listed in Annex III and include: AI in critical infrastructure management; AI in education and vocational training; AI in employment and worker management; AI in access to essential private and public services including credit scoring; AI used by law enforcement; AI in migration, asylum, and border control; AI in administration of justice; and AI in democratic processes. These systems need a conformity assessment before market placement, in most cases through the provider's internal control.
AxiLayer AI prepares the evidence for the Article 43 route, so your system is ready for internal control or notified body review. Contact us to discuss your organization's compliance pathway.
Schedule a Scoping CallThe NIST AI Risk Management Framework (AI RMF 1.0), published in January 2023, provides a voluntary framework for organizations to manage risks associated with AI systems. Unlike the EU AI Act, the NIST AI RMF is non-regulatory, but it is increasingly referenced in U.S. federal AI policy, procurement requirements, and sector guidance, and it provides a robust, practical structure for AI governance.
The NIST AI RMF is a voluntary framework. However, it is increasingly referenced in U.S. federal AI policy, government procurement requirements, and sector-specific guidance. Organizations contracting with federal agencies, financial institutions subject to OCC guidance, and healthcare organizations under FDA AI guidance increasingly treat NIST AI RMF alignment as a de facto requirement.
The NIST AI RMF is a U.S. federal framework providing voluntary guidance on AI risk management organized into four functions: Govern, Map, Measure, and Manage. ISO/IEC 42001 is an international standard for AI management systems that is certifiable by auditors. Both are complementary: NIST AI RMF provides operational risk guidance while ISO/IEC 42001 provides a certifiable management system structure. AxiLayer AI provides assessments against both frameworks.
A NIST AI RMF assessment timeline depends on the scope and complexity of an organization's AI portfolio. A single AI system assessment typically takes 3 to 6 weeks. Enterprise-wide AI program assessments covering multiple systems and governance structures typically require 8 to 16 weeks. AxiLayer AI provides scoped assessments tailored to your organization's needs.
AxiLayer AI conducts NIST AI RMF assessments providing organizations with a documented evaluation of their AI risk management maturity across all four core functions.
Schedule a Scoping CallISO/IEC 42001:2023, "Information technology, Artificial intelligence, Management system," is the world's first international standard for AI management systems. Published in December 2023, it provides organizations with a structured, auditable framework for responsible AI development and deployment, and is certifiable by accredited third-party certification bodies.
Annex A lists the reference controls an organization selects from and justifies in its Statement of Applicability. Annex B gives implementation guidance; Annexes C and D cover AI objectives, risk sources and sector use. Source
An indicative map of where each ISO/IEC 42001 clause meets the EU AI Act and the NIST AI RMF functions. Evidence built once serves all three.
Indicative mapping for planning; the binding test is always the text of each instrument.
Any organization that develops, provides, or uses AI systems can certify to ISO/IEC 42001. This includes technology companies building AI products, enterprises deploying AI in their operations, government agencies using AI in public services, and healthcare or financial organizations using AI in regulated contexts. Certification, where applicable, should be performed through the appropriate accredited certification or notified-body route for the relevant scheme; AxiLayer AI supports readiness and assessment work.
ISO/IEC 42001 certification typically takes 12 to 18 months for organizations implementing the standard from scratch, and 6 to 9 months for organizations with existing ISO 9001 or ISO 27001 management systems. The certification audit itself consists of a Stage 1 documentation review (2 to 4 weeks) and a Stage 2 on-site audit (1 to 3 weeks), followed by certificate issuance within 1 to 2 weeks of successful completion.
ISO/IEC 42001 provides an AI management system framework that addresses many EU AI Act governance requirements, but it does not by itself constitute a complete EU AI Act conformity assessment for high-risk AI systems. Providers of high-risk AI systems under Annex III of the EU AI Act still need an Article 43 conformity assessment, and deployers keep their own duties. ISO/IEC 42001 is not a harmonized standard under the AI Act; the AI Act's own quality management standard, EN 18286, was cited in the Official Journal on 14 October 2026. AxiLayer AI can structure an integrated readiness assessment covering both ISO/IEC 42001 and EU AI Act conformity requirements at the same time.
AxiLayer AI provides ISO/IEC 42001 readiness assessment through a structured Stage 1 and Stage 2 review process, preparing organizations for formal certification by an accredited certifier.
Start Readiness ReviewAccreditation, standards and assurance schemes that now build on the AI management system standard.
ISO/IEC 42001 published Source
Singapore launches a national 42001 accreditation program Source
ISO/IEC 42006 sets requirements for 42001 certifiers Source
CSA STAR for AI builds its Level 2 on ISO/IEC 42001 Source
UKAS announces the first UK 42001 accreditation Source
ANAB accredits the first U.S.-accredited 42001 certifier; EN ISO/IEC 42001:2026 adopted in Europe Source
Japan AI Safety Institute proposes a conformity model that layers on 42001 Source
EN 18286, the AI Act quality management standard, clears its vote Source
ISO/IEC 42003 implementation guidance; ISO/IEC 27090 AI agent security under publication Source
Status and dates reflect public sources reviewed in October 2026; confirm against official texts before relying on them.
This checklist provides organizations with a structured tool for self-assessing their AI system's compliance readiness across the three leading global frameworks. It is designed to be used in preparation for an audit, not as a substitute for one.
The complete 24-page checklist is available as a PDF. Contact us to receive your copy and discuss your compliance readiness assessment.
Request ChecklistThe EU AI Act establishes some of the largest potential fines in corporate history. Use this calculator to estimate your organization's potential exposure and the ROI of proactive compliance.
The EU AI Act is the headline, but AI systems also fall under privacy, consumer and state AI laws with their own ceilings. Maximum figures, verified as of October 2026.
Global average cost of a data breach in 2026
SourceAverage cost of an AI-enabled breach in 2026
SourceExtra breach cost where shadow AI use was high (2025)
SourceOf organizations with AI model or application breaches lacked proper AI access controls (2025)
SourceOf breached organizations had no AI governance policy or were still building one (2025)
SourceAI incidents recorded in 2025, a new high, up from 233 in 2024
SourceSources: IBM Cost of a Data Breach Report 2025 and 2026; Stanford AI Index 2025 and 2026.
EU AI Act penalties for prohibited practices apply
Commission can fine general-purpose AI providers
Colorado SB 26-189 applies, with a cure period to 1 Jan 2030
Korea's AI Basic Act fines can apply once the grace period of at least one year ends
India's DPDP core obligations apply
EU AI Act high-risk fines for Annex III systems
EU AI Act high-risk fines for AI in regulated products
Figures are statutory maximums; actual penalties depend on severity, duration, cooperation and local rules. This page is illustrative and is not legal advice. Sources: AI Act Art. 99 Art. 113 Colorado dates.
Schedule a complimentary consultation with our AI assurance team. We'll find what you run, show you the live controls, assess your current state, identify applicable frameworks, and outline a clear route to signed evidence, at no obligation.
AxiLayer AI is the AI control and assurance company. We find and control AI agents, and we sign the evidence. Join us early, learn quickly and work on problems that matter to enterprises and governments.
Help connect our platform to the identity, cloud and security tools organizations already run.
Help organizations see which AI systems and agents they run, and what to fix first.
Test AI agents and their tools under senior guidance, so that organizations can fix weaknesses first.
Prepare the evidence and documents that a qualified AxiLayer AI auditor reviews.
Lead AI system audits and review the evidence behind a Compliance Passport.
Help future clients get set up, stay supported and see value early.
Find the organizations that need AI agent security and start the conversation.
Learn AI security and software by working on real projects with our team.
Introduce AxiLayer AI to organizations in your region, and earn commission on the business you bring in.
Help organizations see which AI systems and agents they run, and what to fix first.
Prepare the evidence and documents that a qualified AxiLayer AI auditor reviews.
Lead AI system audits and review the evidence behind a Compliance Passport.
Find the organizations that need AI agent security and start the conversation.
Introduce AxiLayer AI to organizations in your region, and earn commission on the business you bring in.
Prepare the evidence and documents that a qualified AxiLayer AI auditor reviews.
Lead AI system audits and review the evidence behind a Compliance Passport.
Find the organizations that need AI agent security and start the conversation.
Introduce AxiLayer AI to organizations in your region, and earn commission on the business you bring in.
Help organizations see which AI systems and agents they run, and what to fix first.
Lead AI system audits and review the evidence behind a Compliance Passport.
Help future clients get set up, stay supported and see value early.
Introduce AxiLayer AI to organizations in your region, and earn commission on the business you bring in.
Lead AI system audits and review the evidence behind a Compliance Passport.
Help future clients get set up, stay supported and see value early.
Find the organizations that need AI agent security and start the conversation.
Introduce AxiLayer AI to organizations in your region, and earn commission on the business you bring in.
Prepare the evidence and documents that a qualified AxiLayer AI auditor reviews.
Lead AI system audits and review the evidence behind a Compliance Passport.
Find the organizations that need AI agent security and start the conversation.
Introduce AxiLayer AI to organizations in your region, and earn commission on the business you bring in.
Help organizations see which AI systems and agents they run, and what to fix first.
Lead AI system audits and review the evidence behind a Compliance Passport.
Help future clients get set up, stay supported and see value early.
Find the organizations that need AI agent security and start the conversation.
Introduce AxiLayer AI to organizations in your region, and earn commission on the business you bring in.
Company announcements will appear here.
Fung Wai Ming (Leo Fung), based in Hong Kong SAR, joins AxiLayer AI to strengthen its presence across fourteen Asia Pacific markets where robotics, embedded AI and AI governance meet.
ROSWELL, GA, October 2026. September was one of the densest single months for AI regulation since the EU AI Act's original adoption in 2024. Binding rules took effect or were finalized across North America, Europe, the Gulf, Asia and Africa within weeks of one another. No single jurisdiction sets the pace anymore, the obligations are arriving in parallel, and in at least one case this month a government AI policy was itself withdrawn for using AI-hallucinated sources. Here is what changed, region by region.
United States. Colorado's Attorney General filed proposed rules on 11 August 2026 implementing the state's Automated Decision-Making Technology and Conversational AI Service framework, with a revised draft expected by 23 September and comments open through 26 October ahead of the law's 1 January 2027 effective date. California's legislature closed its session 27 to 31 August: SB 1000 (removing the one-million-user threshold from the AI Transparency Act and replacing detection tools with disclosure verification) reached the Governor 2 September; SB 947, the "No Robo Bosses Act," would bar employers from relying solely on automated systems to discipline or terminate workers, effective 1 July 2027 if signed; SB 903 and SB 813 awaited a decision by 30 September; SB 928, requiring human instructors at California State University campuses, was signed 27 August. On enforcement, the FTC finalized a $930,000 order against CMG Media on 26 August for using smart-device conversations to target consumers, the SEC sued GenesisAI Corp the next day over misleading marketplace-revenue claims, and Texas stood up the consumer-complaint portal required by TRAIGA's 1 September deadline.
Canada. With Bill C-27 and the Artificial Intelligence and Data Act extinguished by prorogation back in January 2025, Canada remains without a general AI statute, though Bill C-36, tabled in June 2026, addresses significant automated decisions. In its place sits a patchwork: PIPEDA federally, Quebec's Law 25 (in force since September 2023, penalties up to C$25 million or 4 percent of worldwide revenue for automated decisions made without disclosure or human-review rights), the voluntary ISED Code of Conduct that over 40 organizations have signed, the Treasury Board's Algorithmic Impact Assessment directive for federal departments, and sectoral rules including OSFI Guideline E-23 for federally regulated financial institutions, effective 1 May 2027.
European Union. The AI Omnibus, Regulation (EU) 2026/1744, entered into force 27 July 2026. Article 50 transparency duties took effect 2 August 2026; marking obligations for generative systems already deployed before that date shift to 2 December 2026; the Annex III high-risk compliance deadline is now 2 December 2027; and high-risk AI embedded in regulated products under Annex I moves to 2 August 2028. The package also added prohibitions on AI-generated non-consensual intimate imagery and CSAM, and gave the EU AI Office expanded supervisory authority over general-purpose AI models.
United Kingdom. The ICO published its audit of facial-recognition use at five police forces in August 2026, issuing 107 recommendations on governance, data mapping, image sourcing and bias mitigation, and separately recommended that a Statutory Regulatory Sandbox be established through primary legislation. The National Cyber Security Centre issued new guidance on secure agentic-AI deployment, covering agent instruction clarity, sandboxing boundaries, telemetry access and human oversight. The Department for Energy Security and Net Zero opened a call for evidence on AI in the energy sector, closing 6 November 2026, feeding an upcoming AI for Clean Energy Strategy.
Switzerland and the Council of Europe. Switzerland's Federal Council announced its intention, on 12 February 2025, to ratify the Council of Europe's Framework Convention on Artificial Intelligence, the first binding international AI treaty, and instructed the Federal Office of Justice to draft implementation legislation, expected by the end of 2026. Rather than mirror the EU AI Act, Switzerland is pursuing targeted, sector-specific adjustments while meeting the Convention's requirements on human rights risk assessment, transparency and accessible remedies. The European Parliament has separately backed EU accession to the same Convention.
China and East Asia. China's Interim Measures for the Administration of AI Anthropomorphic Interactive Services took effect 15 July 2026, layering onto the AI-generated-content labeling measures already binding since September 2025. South Korea's AI Framework Act and its enforcement decree took effect 22 January 2026; Taiwan's Basic Law on Artificial Intelligence took effect 14 January 2026, followed by an Executive Yuan AI strategy committee in March; Vietnam enacted its own AI law on 1 March 2026, with an implementing decree on 30 April and sector-by-sector high-risk designations across six sectors on 2 July; and India's amended intermediary and digital-media rules took effect 20 February 2026.
Singapore and Hong Kong. Singapore moved fastest on agentic AI specifically: IMDA published what it called the world's first Model AI Governance Framework for Agentic AI in January 2026, the Monetary Authority of Singapore completed phase two of Project MindForge on agentic-AI risk management in March, the Cyber Security Agency warned in April that frontier models can cut exploit-development time from months to hours, IMDA updated its framework with case studies from over 50 organizations in May, and an AI Tester Accreditation Programme, billed as Asia's first AI testing and red-teaming certification, is slated for the third quarter. Hong Kong's Privacy Commissioner ran compliance checks on 60 organizations in January, issued a specific agentic-AI privacy alert in March, and published survey results in May showing 95 percent of organizations now use AI operationally, while the HKMA and SFC issued joint circulars on AI-driven cybersecurity resilience for financial institutions between April and June. Japan and Australia remain on voluntary, principles-based tracks rather than binding statute, for now.
Middle East and the Gulf. The UAE established a new Federal Artificial Intelligence and Data Authority on 14 June 2026, consolidating the Office of AI, the UAE Data Office and TDRA's digital-government portfolio. The Central Bank of the UAE's Guidance Note on Consumer Protection and Responsible Adoption of AI/ML, issued 11 February and announced 23 February 2026, now requires board accountability, annual model testing, graduated human oversight and vendor audit rights for licensed financial institutions. Saudi Arabia closed public consultation on its draft Responsible AI Policy, a four-tier risk classification, on 3 May 2026, with SDAIA's national AI Risk Management Framework following in July 2026.
Brazil and Latin America. Brazil's AI bill, PL 2338/2023, passed the Federal Senate on 10 December 2024 and remains stalled: the Chamber of Deputies received it 17 March 2025, and its special committee has not delivered the opinion needed for a floor vote, even as newer AI proposals are formally attached to the same legislative file. As of this briefing, nothing in PL 2338 binds anyone or has legal effect, a reminder that Senate passage and enacted law are not the same thing when a bill is tracked as "coming."
Africa. South Africa published a draft National AI Policy on 10 April 2026, proposing seven new oversight bodies including a National AI Commission and an AI Ombudsperson, only to withdraw it sixteen days later, on 26 April, after the minister discovered the policy's own reference list contained fabricated, AI-hallucinated sources; four officials were suspended pending investigation. Nigeria took the opposite path to the same deadline pressure, converting its National Digital Economy and E-Governance Bill, published 17 January 2026, into binding statutory law with risk-based oversight of AI used in credit decisions, identity verification and surveillance, annual impact assessments, and penalties up to 2 percent of locally derived revenue, one of the only African AI frameworks with real enforcement teeth so far.
The AxiLayer AI view: the instruments differ, but the pattern does not. Every region now asks for the same four things: a documented inventory of AI in use, validation scaled to risk, contractual audit rights over vendors, and a continuous evidence record rather than a point-in-time attestation. South Africa's withdrawn policy is the sharpest illustration yet of what happens without that discipline, a government document undone by the exact failure mode, unverified AI output treated as fact, that an evidence chain exists to catch. An organization that builds one evidence program to that standard is positioned for all of these regions, not just the jurisdiction that happens to enforce first.
BRUSSELS, June 2026. On 7 May 2026, negotiators from the European Parliament, the Council of the EU, and the European Commission reached a provisional agreement on the AI Omnibus, the first set of amendments to the EU AI Act since its adoption in 2024. That agreement has since been adopted as Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force since 27 July 2026. The regulation replaces the 2 August 2026 high-risk compliance deadline with a staggered, fixed-date timeline that gives organizations and standards bodies additional time to prepare.
Under the agreement, obligations for standalone high-risk systems listed in Annex III, including recruitment, credit scoring, education, law enforcement, and border-control tools, are deferred to 2 December 2027. High-risk AI embedded in regulated products under Annex I, such as medical devices, machinery, and vehicles, moves to 2 August 2028. Marking obligations for AI-generated content under Article 50(2) shift to 2 December 2026, while all other transparency duties still apply from 2 August 2026.
The package also introduces a new prohibition on AI used to generate non-consensual intimate imagery and child sexual abuse material, extends the legal basis for bias-detection data processing to all AI systems, and postpones the national regulatory-sandbox requirement to August 2027.
The AxiLayer AI view: the deferral is a planning window, not a reprieve. Mandatory conformity assessments, Annex IV technical documentation, and post-market surveillance obligations are unchanged in substance, and building credible, audit-ready evidence still takes twelve to eighteen months. Organizations that treat the new timeline as runway, rather than delay, will be the ones holding signed evidence and contract-ready when enforcement arrives.
ROSWELL, GA, March 2026. AxiLayer AI, Inc., the AI control and assurance company headquartered in Roswell, Georgia, today announced the launch of its Alliance Ecosystem, a structured partnership program designed to bring together consulting firms, legal practices, technology companies, systems integrators, and academic institutions committed to advancing responsible and accountable artificial intelligence.
The Alliance Ecosystem establishes four formal partnership tiers, Technology Alliance, Consulting & Advisory Alliance, Implementation Alliance, and Academic & Research Alliance, providing organizations with structured frameworks for co-delivering AI assurance services, co-authoring thought leadership, and co-hosting educational events.
"As AI regulation moves from voluntary guidance to mandatory enforcement, no single organization can serve the full scope of enterprise and government need alone," said Ovi Pinzaru, Founding Partner and Chief Executive Officer of AxiLayer AI. "Our Alliance Ecosystem is designed to connect the organizations best positioned to serve that need, working together, under a shared commitment to standing, integrity, and the highest standards of professional practice."
Alliance partner applications are now open.
For speaking engagements, media inquiries, or podcast appearances, contact our team.
Contact UsAxiLayer AI, Inc. is the AI control and assurance company: it finds and controls every AI agent, and signs the evidence. Its findings are reviewed and signed by qualified AxiLayer AI auditors and reported as found. Its ten service lines include AI system auditing, algorithm assurance, risk assessment, compliance readiness, continuous monitoring, public sector AI policy and family safety assurance, delivered through the AxiSentinel platform and the AxiReady discovery service. AxiLayer AI is incorporated in Delaware and headquartered in Roswell, Georgia. Learn more at www.axilayerai.com.
Follow AxiLayer AI on LinkedIn for announcements and insights.
Follow on LinkedInA 45-minute session for executives and compliance leads on where your AI systems stand against the rules of each market you operate in. No commitment beyond the call.
Request a briefingOur leadership team is available to speak on AI regulation, AI control and assurance, and governance frameworks at industry conferences, corporate events and government briefings.
153 AI governance, regulation, assurance, security and industry events across every region, from November 2026 through December 2027, including the conferences shaping how AI is governed worldwide.
Regulators and financial institutions discuss AI use, supervision and fintech policy in Hong Kong.
Event website →China's flagship internet governance forum, with security governance and open-source AI on the agenda.
Event website →Closed-door CIO assembly on scaling enterprise AI, where governance and assurance needs surface.
Event website →Privacy and security law forum with workshops on generative and agentic AI liability.
Event website →Mainly virtual ANAB meeting for scheme owners, with sessions on AI's impact on accreditation.
Event website →Banking and insurance AI leaders discuss trusted AI governance and scaling AI in regulated institutions.
Event website →Asia-Pacific language technology research, including evaluation and safety of large language models.
Event website →Clinical informatics meeting covering ambient AI, decision support and governance.
Event website →Israel's main applied AI conference, with research on robust and trustworthy systems.
Event website →ITU's top policy-making body sets priorities and leadership for global digital and AI standards work.
Event website →One of Europe's largest tech gatherings, with AI policy and adoption on the main stages.
Event website →Multistakeholder forum where emerging technology and AI governance feature among core themes.
Event website →Japan's largest dedicated AI trade exhibition, covering enterprise AI adoption in Japan.
Event website →Online event for internal auditors assessing cybersecurity risk, closely linked to AI system controls.
Event website →Annual gathering of the IEC, co-owner with ISO of the international AI standards committee.
Event website →Large health innovation event where provider and payer AI adoption is a central topic.
Event website →Annual meeting of data protection authorities worldwide; open sessions 18-19 Nov address AI oversight.
Event website →Europe's main privacy professional gathering, with substantial EU AI Act and AI governance content.
Event website →Covers EU AI Act obligations and IP risk governance in AI deployments for in-house counsel.
Event website →Hosted by the European Commission AI Office; closes European AI Innovation Month. Hybrid format.
Event website →Karnataka government's flagship tech summit themed AI and Beyond, drawing policymakers and enterprises.
Event website →Policymakers and banks discuss fintech regulation and AI adoption in the Moroccan economy.
Event website →Free virtual summit on Zero Trust strategies for securing identity and governing AI.
Event website →AI conference covering applied AI in healthcare, fintech, government services and defense.
Event website →MAS-backed gathering where regulators and banks address AI risk management in financial services.
Event website →Thai enterprise technology show covering AI, cloud and cybersecurity adoption by business buyers.
Event website →Governing meeting of European accreditation bodies, relevant to conformity assessment under the EU AI Act.
Event website →Largest regional cybersecurity event, increasingly focused on securing AI systems and models.
Event website →Privacy and AI governance professionals across Australia and New Zealand discuss regulatory compliance.
Event website →Three-day online conference for IT audit, risk and digital trust professionals, with CPE credits.
Event website →Multistakeholder OECD-hosted convention on trust and integrity in the generative AI era.
Event website →Flagship machine learning conference where evaluation, safety and accountability research is presented.
Event website →ADGM hosted finance week where regulators and institutions discuss AI in financial services.
Event website →Security research conference where attacks on AI systems and model security are increasingly covered.
Event website →Region's flagship tech show where governments and enterprises announce AI programs and procurement.
Event website →Public sector agencies sharing AI governance policies and procurement practices; town hall on 11 Dec.
Event website →Americas site of the leading machine learning research conference; main venue is Sydney.
Event website →European satellite of the leading machine learning conference, covering evaluation, robustness and fairness research.
Event website →Enterprise AI event with speakers on AI risk management and responsible AI.
Event website →First IGF since becoming a permanent UN forum, themed on governing the internet in the age of intelligence.
Event website →Nordic CIO conference focused on scaling AI, cyber risk and digital change.
Event website →Global business and government leaders meet, with AI governance a recurring agenda topic.
Event website →ANAB's annual symposium on accreditation trends, relevant to AI conformity assessment.
Event website →Thai cybersecurity and AI event backed by Thailand's national cybersecurity authority (NCSA).
Event website →Major cybersecurity conference covering AI threats, defenses and government cyber policy.
Event website →Largest regional healthcare expo, with growing attention to clinical AI safety and validation.
Event website →Large Gulf tech gathering of founders, investors and officials shaping AI adoption in Qatar.
Event website →Dedicated forum on AI Act implementation, AI auditing challenges and privacy compliance.
Event website →India's tech industry body convenes leaders on AI adoption, policy and responsible technology.
Event website →Heads of government and ministers set direction on AI governance and public sector AI.
Event website →AI conference on practical deployment across Saudi government, finance, energy and healthcare.
Event website →London enterprise AI expo where practitioners discuss deploying and governing generative AI and ML.
Event website →Pan-African tech and investment event connecting startups, corporates, investors and regulators.
Event website →Enterprise AI event with policymaker participation, focused on moving AI from pilot to production.
Event website →Major AI research conference that also hosts sessions on safety, ethics and responsible AI.
Event website →Japanese regulators and financial firms discuss fintech innovation and AI in financial services.
Event website →Beijing's national science and technology forum, regularly featuring AI policy and governance discussions.
Event website →Senior gathering on AI in European defense, procurement and policy.
Event website →20th edition of the leading academic and regulatory conference on privacy, data protection and AI.
Event website →Includes sessions on data, analytics and AI governance, risk, privacy and ethics.
Event website →European cybersecurity forum with a dedicated Secure AI track on agentic and autonomous systems.
Event website →Part of Tech Show London; data and AI leaders discuss deployment, data quality and governance.
Event website →Digital health conference for health system leaders evaluating and deploying AI.
Event website →Gartner summit at ICC Sydney for security and risk leaders, including AI risk topics.
Event website →Inaugural Latin American edition of GITEX covering AI, cybersecurity and fintech.
Event website →Nordic leadership event on AI in the workplace and preparing organizations for responsible adoption.
Event website →The largest annual gathering of privacy, AI governance and cybersecurity law professionals.
Event website →Audit leadership conference with a track on AI governance and intelligent audit.
Event website →Confirmed to return to Montréal in 2027; past editions held in spring.
Event website →Education topics include AI policy, governance and responsible use in healthcare.
Event website →IAPP's European AI governance conference, co-located with the UK Intensive in 2027.
Event website →The largest annual cybersecurity conference, with extensive AI agent security programming.
Event website →Spring edition of Japan's largest IT and DX show, covering AI tools and security.
Event website →Saudi Arabia's largest tech event, with the DeepFest AI stage running alongside.
Event website →Korea's largest AI exhibition, relevant to enterprises preparing for Korea's AI Basic Act.
Event website →Spring edition of Japan's dedicated AI exhibition covering enterprise and physical AI.
Event website →Largest global internal audit gathering, attended in person or online by risk and governance professionals.
Event website →Africa's largest tech show, where governments present digital and AI policy agendas.
Event website →Leading deep learning conference with growing work on model evaluation, robustness and safety.
Event website →Data governance conference on regulatory developments and emerging technologies including AI.
Event website →Regional fintech show where banks and payment firms discuss AI and compliance in Asia.
Event website →Bloomberg powered forum of heads of state and CEOs where AI economic policy features.
Event website →Large Asian tech event focused on how AI gets funded, adopted and scaled.
Event website →Second annual UN dialogue where member states and stakeholders discuss international AI governance.
Event website →Hybrid conference for IT audit, risk and governance professionals, including AI audit.
Event website →Major computational linguistics conference with research relevant to language model evaluation.
Event website →Defense cyber event linking DoD network defense leaders with industry and academia.
Event website →Public-private AI event at KICC drawing East African governments and enterprises.
Event website →Long-running German AI conference for decision makers; held in Berlin with a virtual option.
Event website →SCSP's national security and AI policy expo for government, industry and academia.
Event website →Payments, banking and digital commerce event where AI use in financial services is discussed.
Event website →Nordic AI and data expo with conference themes covering privacy, security and governance.
Event website →Canada's main privacy conference, covering AI governance and regulatory developments.
Event website →IMDA's flagship event where ATxSummit gathers ministers and industry on AI governance.
Event website →Capital markets practitioners discuss AI use cases, model risk and regulatory expectations.
Event website →Major public sector cloud and AI event for federal, state and local agencies.
Event website →Includes a dedicated Data, Analytics and AI Governance track for Brazilian leaders.
Event website →Gartner summit at ICC Sydney for data, analytics and AI leaders in enterprise settings.
Event website →UK flagship tech week where government AI policy announcements and industry adoption converge.
Event website →European health IT conference where clinical AI adoption and oversight are recurring topics.
Event website →Europe's largest cybersecurity event, with growing coverage of AI risk and AI-enabled threats.
Event website →Europe's major fintech event, where banks and payment firms discuss AI deployment and regulation.
Event website →Commercial AI conference during London Tech Week, with enterprise adoption and responsible AI tracks.
Event website →Security and risk leaders' summit, increasingly focused on securing and governing AI.
Event website →South America's largest tech gathering, with strong AI programming.
Event website →Major European tech show where AI policy leaders and large enterprises meet.
Event website →Regional accreditation body meetings shaping mutual recognition of inspection and certification results.
Event website →Top computer vision research venue, relevant to biometric and vision system assurance.
Event website →ITU's UN platform on AI standards and governance, held back to back with the Geneva AI Summit.
Event website →Swiss government-hosted summit on trustworthy, responsible and safe AI under the theme Bridging Innovation and Trust.
Event website →Large European health innovation event where AI in care delivery and its oversight are discussed.
Event website →Fintech week including Point Zero Forum, a policy and industry forum on financial technology.
Event website →Asia's main privacy and AI governance professional forum, listed by IAPP for July 2027.
Event website →China's largest AI conference, with a governance track on global AI cooperation and rules.
Event website →Large Paris AI summit for executives, investors and builders, expanding to three days in 2027.
Event website →Flagship security research conference with growing AI and LLM attack research.
Event website →Annual Bangkok technology and business summit with substantial AI adoption programming; 2027 dates not yet published.
Event website →Long-running AI research conference covering ethics, trustworthy AI and AI for social good tracks.
Event website →Korean enterprise AI conference and expo, covering adoption under Korea's AI law.
Event website →Satellite program of IJCAI 2027 for researchers based in Greater China.
Event website →Governance, risk and compliance conference for audit and assurance practitioners.
Event website →Top language model research venue, including work on bias, evaluation and transparency of LLMs.
Event website →Major defense and security exhibition where AI-enabled defense systems and procurement are showcased.
Event website →Large AI conference gathering builders, investors and enterprise adopters in Singapore.
Event website →Gartner flagship CIO and IT executive conference at Brisbane Convention and Exhibition Centre.
Event website →Includes a Government Leadership AI Summit in Abuja, relevant to public sector AI governance.
Event website →Annual Amsterdam enterprise AI expo; 2027 dates not yet published by the organizer.
Event website →Annual African AI trade event for enterprise and public sector AI buyers.
Event website →Annual Riyadh investor and policy forum where AI strategy and investment are central themes.
Event website →Annual autumn IT and DX show with AI automation and information security expos.
Event website →Annual CSA-hosted week where regional governments shape cybersecurity and AI agent security policy.
Event website →Annual Amsterdam AI summit during World AI Week; 2027 dates not yet published.
Event website →28th European Conference on Artificial Intelligence, Europe's main general AI research conference.
Event website →Premier computer vision conference, relevant to biometric and vision system fairness and assurance.
Event website →Annual Israeli applied AI conference relevant to research on trustworthy and secure AI.
Event website →Annual Karnataka government tech summit with growing focus on AI policy and adoption.
Event website →Annual regional cybersecurity event with growing focus on AI system security.
Event website →Annual Hong Kong fintech gathering where regulators address AI in financial services.
Event website →Annual Brussels privacy congress with AI Act content; 2027 dates not yet published.
Event website →Annual MAS-backed festival central to AI governance discussions in Asian finance.
Event website →Annual Lisbon tech conference; 2027 dates not yet announced by the organizer.
Event website →Annual Chinese internet governance summit with recurring AI governance sessions.
Event website →Online IIA event on enterprise risk, useful for integrating AI risk into ERM programs.
Event website →CIO assembly on enterprise AI maturity, where governance and assurance requirements are raised.
Event website →Annual ADGM finance week where regulators and institutions discuss AI in finance.
Event website →No events match these filters.
Calendar updated 4 November 2026. Dates and venues are set by each organizer; please confirm on the event website. Want to meet AxiLayer AI at one of these events? Contact us.
Prefer email? Write to contactus@axilayerai.com and we will let you know about upcoming sessions.
As AI regulation moves from voluntary guidance to mandatory enforcement, organizations across every sector need a trusted assurance partner. AxiLayer AI's Alliance Ecosystem brings together the firms, institutions, and innovators best positioned to serve that need, collectively and at scale.
Any relationship between a partner and a system we assess is disclosed and checked before work starts. A qualified AxiLayer AI auditor who did not build the system signs every finding.
Founding partner positions are currently being filled.
Partners own the client relationship, the advice and the implementation. AxiLayer AI owns the assessment and the signed evidence. The lanes never cross on a finding.
Partner spots an AI compliance need with a client
Joint scoping of systems, markets and frameworks
AxiLayer AI tests and a qualified AxiLayer AI auditor signs every finding
Partner leads legal advice, implementation and fixes
AxiSentinel keeps evidence current; partner tools consume it
Fundamental rights and data protection impact assessments with law firms; Cyber Resilience Act evidence with integrators; AI Act readiness before 2 Dec 2027.
A government roadmap and a BCS-led consortium are building the AI assurance profession.
Bias audits under NYC Local Law 144 and California's FEHA rules for HR technology buyers; CPPA risk assessments; federal AI procurement terms.
Korea's AI Basic Act, Vietnam's pre-deployment assessments, Singapore's AI Verify and agentic AI framework.
DIFC Regulation 10, Qatar Central Bank prior approval of AI systems, Saudi Arabia's draft Responsible AI Policy.
Peru's phased AI rules, Chile's and Brazil's AI bills, the African Union Continental AI Strategy.
Market figures from the UK government study Assuring a Responsible Future for AI (November 2024).
We review all alliance applications carefully. If your organization is a strong fit, our team will reach out within five business days.
See where you stand across five areas: find, secure, contain, prove and comply. Get your result on screen, with the first steps to take.
Enter your annual revenue. We show the highest fine the law allows in each region, across AI and data protection laws.
Short briefs on the laws, standards and threats shaping AI agents, each connected to the services and integrations that help you act.
On 11 September 2026 the Fed, FDIC, OCC and NCUA proposed nonbinding vendor risk guidance, with comments due 16 November. Reporting also describes informal supervisor questions to banks about AI agent limits and shutdown, while a promised request for information on AI had not appeared as of 24 October.
The Commission proposed the EU KIDS Act on 17 September 2026, bringing AI companions and general conversational chatbots into scope, including providers outside the EU. It remains a proposal, and fines for these providers could reach 6% of worldwide annual turnover.
New Article 5 points banning systems that generate non-consensual intimate depictions of identifiable people and child sexual abuse material apply from 2 December 2026. The same date ends the Article 50(2) machine-readable marking grace period, which covers only generative systems placed on the market before 2 August 2026.
The Colorado Attorney General held the formal rulemaking hearing on 26 October 2026 and closed written comments the same day. Final rules are not yet adopted, and the office must adopt them before both acts take effect on 1 January 2027.
New York's RAISE Act takes effect on 1 January 2027 for frontier model developers. Developers must report safety incidents to the state within 72 hours of learning of them or of facts supporting a reasonable belief that one occurred.
IBM bulletins list critical Langflow flaws, including an authentication bypass and unauthenticated code execution, across releases 1.0.0 through 1.12.8. Version 1.13.0 is the fix, none of the four main flaws was on the CISA KEV list as of 30 October, and a public Metasploit module targets one of them.
New York enacted S 9051-B in late October 2026, barring twelve categories of unsafe AI companion features for minors unless an operator uses age assurance to determine a user is not a minor. It takes effect 1 June 2027, with Attorney General enforcement and penalties up to $25,000 per violation.
The House of Representatives passed the Online Safety Amendment (Digital Duty of Care) Bill 2026 on 28 October, and it now goes to the Senate. An amendment requires platforms to consider attachment hacking, such as chatbots using emotional language to engage children, as a potential harm.
The Bank of England and FCA survey found 86% of respondents use AI and 80% have AI agents deployed, while only 2% use broad autonomy. Vendor-supplied systems now make up 53% of high-materiality AI systems, up from 35% in 2024.
OWASP published an eight-phase manual for assessing the security, safety and robustness of generative AI systems, running from scoping through remediation. It covers AI agents as well as models, applications and multimodal interfaces.
NIST renamed its control overlays project COSIS on 20 October 2026 under the 29 September executive order on Super Intelligence terminology. The project page lists only a concept paper and a January 2026 discussion draft outline, with no finished overlay.
A secondary report says CERT-In issued a high-severity advisory on 17 October 2026 calling AI agents a rapidly expanding attack surface. The report lists shadow AI, exposed inference servers and stolen API keys among the risks, and the original advisory could not be checked.
The agencies published voluntary guidance on incidents where agents take significant unintended actions that bypass policies, controls or human oversight. Its ten practices span preparation, detection, response, recovery and reporting, and draw on NIST SP 800-61r3.
The Hong Kong Monetary Authority announced its ART Framework for responsible AI adoption on 15 October 2026. It also plans a discussion paper on agentic AI governance covering purpose-based accountability, a registry of material agents and intervention mechanisms.
CEN-CENELEC announced that EN 18286:2026 on quality management systems has been cited in the Official Journal. The citation gives providers of high-risk AI systems a route to a presumption of conformity with the relevant AI Act provisions.
The Commission announced on 14 October 2026 the AI Office's first requests for information to providers of general-purpose AI models with systemic risk. A consultation on the draft penalty procedure rules opened 12 October and runs until 9 November 2026.
The ICO said ten AI developers have made or committed to data protection changes, and it opened a six-week call for evidence on AI agents. Responses are due 20 November 2026 and will inform guidance and a statutory code on AI and automated decision-making.
A status review reports that the IESG approved the agentproto working group charter on 8 October 2026, covering user-to-agent, agent-to-agent and agent-to-tool interactions. The WIMSE AI Identity Management System draft, published 15 September, was the only working group document it found on agent authentication and authorization.
The Monetary Authority of Singapore published its AI risk management guidelines on 7 October 2026. Governance requirements take effect on 7 October 2027, and lifecycle controls and capability requirements follow in October 2028.
CISA submitted the final CIRCIA rule to the Office of Information and Regulatory Affairs on 1 October 2026, one of the last steps before Federal Register publication. Review can take up to 90 days or longer, and the rule will likely take effect at least 60 days after publication.
The AI Agent Accountability Act would expose operators to criminal and civil liability under the Computer Fraud and Abuse Act if they knowingly deploy an agent that recklessly causes hacking damage. Developers would face the same exposure if they knew or should have known an agent could hack and lacked reasonable safeguards.
Executive Order 14434 directs agencies to use Super Intelligence and SI in place of artificial intelligence and AI, defined by the existing statutory AI definition for now. Within 60 days, about 28 November 2026, the science adviser must propose legislative language on a definition.
NIST's NCCoE summarized 614 responses to its software and agent identity concept paper and launched an online resource hub. The first implementation use case is agents in the software development lifecycle, and a draft project description will follow.
ATLAS release 2026.09 adds 11 techniques, including multimodal input triggers and AI agent response biasing. Release 2026.08 on 31 August added about 19 techniques, mainly on autonomous reconnaissance, agent-to-agent communication and agent tools.
Cyber Resilience Act reporting obligations began for manufacturers on 11 September 2026, covering actively exploited vulnerabilities and severe incidents. ENISA launched the initial Single Reporting Platform the same day, and main cybersecurity requirements follow on 11 December 2027.
Governor Newsom signed SB 1119 on 10 September 2026, requiring risk assessments, crisis protocols, protective defaults and audits for companion chatbots. Most substantive requirements become operative on 1 July 2027, and initial audits are due by 1 January 2029.
Governor Newsom signed SB 813 and AB 1405 on 9 September 2026. They set criteria for AI verification organizations by 1 January 2028 and require anyone conducting a covered AI audit to register from 1 January 2029.
The OWASP GenAI Security Project unveiled its 2026 Top 10 for LLM Applications, with Excessive Agency ranked third. It also received the donated Agent Control Standard, which extends agentic guidance toward runtime enforcement.
A legislative monitor reports that the rapporteur for PL 2338/2023 said on 24 August 2026 that the committee vote would wait until after the October elections. The bill is awaiting the rapporteur's opinion in a special committee and creates no obligations yet.
MCP maintainers published an updated roadmap with five priority areas, including agent identity and enterprise security. It covers proof of possession, workload identity federation and token exchange instead of long-lived API keys, and it sets no date for the next specification.
Article 50 transparency obligations began applying on 2 August 2026, and the Commission's power to enforce general-purpose AI model obligations, including fines, began the same day. Neither was deferred by the AI Omnibus.
The regulation was published on 24 July and entered into force on 27 July 2026. Annex III high-risk obligations move to 2 December 2027, and AI inside Annex I products moves to 2 August 2028.
The Commission adopted guidelines on transparency obligations, complementing the Code of Practice on Transparency of AI-generated Content. They arrived two weeks before the obligations applied.
HB 26-1263 was signed on 1 July 2026 and adds duties for conversational AI, including age estimation, AI disclosure and safeguards for teenage users. Operator duties begin 1 January 2027.
SB 26-189, signed on 14 May 2026, replaces SB 24-205 with a disclosure and rights framework for automated decision-making technology, effective 1 January 2027.
The agencies issued SR 26-2, OCC Bulletin 2026-13 and FDIC FIL-15-2026, replacing SR 11-7 with risk-based model risk management tied to materiality.
CEN approved EN ISO/IEC 42001:2026 on 13 March 2026, an identical adoption of ISO/IEC 42001. National bodies must give it national status by September 2026.
Check your exposure across every region, or talk to our team.
For information only, not legal advice. Items describing bills, proposals and reports are marked as such. Check the current text before relying on any date.
Tell us about your AI systems and your deadlines. We will confirm your scope and show what working together would look like.
The AI control and assurance company: find and control every AI agent, and sign the evidence. For organizations operating across fourteen Asia Pacific markets, system by system and jurisdiction by jurisdiction, from our headquarters in the United States.
AxiLayer AI is available to organizations in Asia Pacific from its United States headquarters, with a regional partner on the ground. Our regional team will grow as our work in the region grows.
Leo Fung is AxiLayer AI's Authorized Regional Partner for Asia Pacific. He has worked in robotics and industrial automation since 2017, helping manufacturers bring industrial, cleaning and material-handling robots to customers in the United States, Europe, Japan and the Middle East, and he has spent the last several years at the point where robotics, embedded AI and AI governance meet. He holds an MBA and a Master of Science degree and is based in Hong Kong. Leo supports enterprises, industry groups and public bodies across the region as they engage with AxiLayer AI's AI assessment services, working alongside our team in the United States.
"Across the region, organizations are asking how to prove their AI is safe, fair and compliant. AxiLayer AI answers that question with rigorous, evidence-based assessment, and I look forward to bringing that capability to leaders across Asia Pacific."
All engagements are scoped, contracted, delivered and signed by AxiLayer AI, Inc. in the United States. Organizations may contact AxiLayer AI directly at any time. Regional partners and representatives support client relationships; proposals, agreements and Compliance Passports are issued only by AxiLayer AI, Inc. through its CEO and its CFO & COO.
AxiLayer AI welcomes Fung Wai Ming (Leo Fung) as Authorized Regional Partner, Asia Pacific, based in Hong Kong SAR. Leo strengthens our presence in a region where robotics, embedded AI and AI governance meet. Organizations across Asia Pacific are welcome to contact AxiLayer AI directly or through our regional partner.
ROSWELL, Georgia and HONG KONG SAR, 15 October 2026. AxiLayer AI, Inc., the AI control and assurance company, is pleased to announce the appointment of Fung Wai Ming (Leo Fung) as Authorized Regional Partner, Asia Pacific, effective 15 October 2026. Based in Hong Kong, Leo joins the AxiLayer AI global network, working alongside our team in the United States.
AxiLayer AI covers the rules of 43 countries on six continents, and Asia Pacific is one of the regions where AI adoption and AI regulation are moving fastest at the same time. Korea's AI Basic Act and Vietnam's AI Law are now in force, Singapore has set firm expectations for AI risk management in financial services, Japan's AI Promotion Act is in effect, and mainland China enforces labeling and algorithm filing. Organizations that build, buy or export AI-enabled systems across these markets need one evidence record that holds up in each of them. We also track 201 AI audit mandates across 81 countries and 8 regions.
AxiLayer AI provides that evidence. Its AxiSentinel platform, live and deployable across cloud, on-premises and air-gapped environments, maps AI systems against 220+ regulatory frameworks and 940+ obligations across 66+ jurisdictions in 43 countries. Every finding is reviewed and signed by a qualified AxiLayer AI auditor. We also track 201 AI audit mandates across 81 countries and 8 regions.
As Authorized Regional Partner, Leo Fung supports enterprises, industry groups and public bodies across the region as they engage with AxiLayer AI's services, with a focus on the sectors where robotics, embedded AI and governance meet: industrial robots and cobots, automotive and electric vehicles, medical robots and devices, logistics and warehousing, service robots and smart factories. He has worked in robotics and industrial automation since 2017 and holds an MBA and a Master of Science degree.
"Asia Pacific is where AI adoption and AI regulation are moving fastest at the same time," said Ovidiu Pinzaru, Founding Partner and CEO of AxiLayer AI. "Organizations there need a partner that can show, system by system and jurisdiction by jurisdiction, where they stand. Leo's experience and understanding of the region strengthen the way we serve them."
"Across the region, organizations are asking how to prove their AI is safe, fair and compliant," said Leo Fung. "AxiLayer AI answers that question with rigorous, evidence-based assessment, and I look forward to bringing that capability to leaders across Asia Pacific."
AxiLayer AI's Asia Pacific coverage includes Hong Kong SAR, Singapore, Malaysia, Thailand, Japan, South Korea, mainland China, Taiwan, Australia, New Zealand, Vietnam, Indonesia, the Philippines and India. The company intends to appoint additional regional representatives as its work in the region grows. All engagements are scoped, contracted, delivered and signed by AxiLayer AI, Inc. in the United States.
Organizations in Asia Pacific interested in AI readiness, assessment or continuous compliance monitoring can request a briefing directly through the AxiLayer AI contact page or through our regional partner.
Asia builds most of the world's robots, vehicles, devices and electronics, and more of them now run on AI. Our regional focus follows the industries Leo Fung has worked in for years, so the questions we answer are the ones your buyers and regulators are already asking.
Robots now see, plan and adapt. Once a machine-learning model sits inside a safety function, buyers and regulators expect evidence that it behaves safely in every plant it ships to.
Vehicles and the plants that build them are now software platforms. Perception, driver monitoring and battery models are reviewed by type-approval authorities and by every carmaker in the supply chain.
Surgical, rehabilitation and hospital robots are among the fastest-growing robots in the world. Every one of them needs clinical evidence, controlled model updates and a clean risk file before it reaches a new market.
Autonomous mobile robots, automated forklifts and AI picking cells now run warehouses around the clock. Operators and insurers want to know how they detect people, recover from faults and log incidents.
Cleaning, delivery, reception and security robots work in airports, malls, hotels and hospitals, among the public. They carry cameras and microphones, so safety and privacy evidence matter as much as performance.
Electronics, semiconductor and component plants feed every global brand. Those brands now ask their suppliers to prove how their AI is governed before they renew a contract.
Market figures: International Federation of Robotics, World Robotics 2025. Rules summarized for orientation; AxiLayer AI confirms what applies to each system and market.
One assessment, signed once, reused for every market a product is sold into, instead of a new audit for every buyer.
Built and tested in Asia Pacific
Reviewed and signed by a qualified AxiLayer AI auditor; re-verifiable by any buyer
EU AI Act high-risk duties, the Machinery Regulation from 20 January 2027, CE marking and buyer audits.
Buyer due diligence against NIST AI RMF, robot and device safety standards, FDA for medical AI and new state AI laws.
AI Promotion Act, AI Guidelines for Business and the safety standards Japanese buyers already apply.
National AI ethics principles and the evidence government and enterprise buyers request in procurement.
Asia Pacific is where AI adoption and AI regulation are moving fastest at the same time. Korea and Vietnam now have binding AI laws, Singapore's financial regulator has set firm expectations for AI risk management, mainland China enforces labeling and algorithm filing, and India, Malaysia, Thailand and Taiwan are building their own rules.
Organizations that build, buy or export AI-enabled systems across these markets need one evidence record that holds up in each of them.
AI Basic Act in force since 22 January 2026. High-impact AI duties in health care, hiring, loan screening, energy, transport and biometrics; generative AI labeling. Fines apply after a one-year grace period, from January 2027.
AI Promotion Act in force since June 2025 and a national AI Basic Plan. No fines; buyers rely on AI Safety Institute evaluation guidance and the AI Guidelines for Business.
MAS Guidelines on AI Risk Management for financial institutions, applying from October 2027. Model AI Governance Framework, now covering agentic AI, and AI Verify testing. MAS SAFR safeguards for AI agents in finance (July 2026).
Labeling Measures for AI-generated content in force since September 2025, algorithm and generative AI filing, and AI provisions in the amended Cybersecurity Law. AI agent Implementation Opinions (May 2026): tiered rules, with filing, testing and recall for sensitive sectors and human review of agent actions.
Hong Kong: PDPO, the PCPD Model Personal Data Protection Framework for AI and HKMA guidance on generative AI. Taiwan: AI Basic Act, with sector rules to follow.
Law on Artificial Intelligence in force since 1 March 2026. Risk tiers, conformity assessment before high-risk systems are deployed, and a local contact point for foreign providers.
DPDP Act and Rules, phased in through 2027. RBI FREE-AI framework for banks and lenders, and national AI governance guidelines.
Malaysia has drafted an AI Governance Bill; Indonesia's OJK has issued AI governance for banks; Thailand is drafting AI legislation; the ASEAN Guide on AI Governance and Ethics applies across the region. Thailand's PDPC guidelines on personal data in AI (October 2026).
Australia's National AI Plan relies on existing law, privacy reform and the Voluntary AI Safety Standard; the TGA regulates AI in medical software. New Zealand follows a light-touch, principles-based approach.
Summary for orientation only, current as of October 2026. Requirements depend on the system, the sector and the market; AxiLayer AI confirms the applicable rules for each engagement.
Assessment evidence is reviewed and signed by AxiLayer AI, Inc. in the United States. Client data stays where the client keeps it; AxiSentinel runs in cloud, on-premises or air-gapped mode.
Audit engagements we deliver today, to start with. If it runs on AI, we can audit it: tell us what you run and we will scope it.
Where you sell. One engagement also covers your export markets: the EU AI Act and the Machinery Regulation, the United Kingdom, US buyers and state AI laws, and the Middle East.
With AxiLayer AI's CEO and CFO & COO. Book it directly with us or through our regional partner.
AI inventory, classification against each target market, written gap list. Typically 4 to 6 weeks.
Evaluation against the applicable frameworks, review and signature by a qualified AxiLayer AI auditor, signed Compliance Passport. Typically 6 to 10 weeks for a first product or system.
AxiLayer AI, Inc. is the AI control and assurance company: it finds and controls every AI agent, and signs the evidence. Its findings are reviewed and signed by qualified AxiLayer AI auditors and reported as found. Its ten service lines include AI system auditing, algorithm assurance, risk assessment, compliance readiness, continuous monitoring, public sector AI policy and family safety assurance, delivered through the AxiSentinel platform and the AxiReady discovery service. AxiLayer AI is incorporated in Delaware and headquartered in Roswell, Georgia. Learn more at www.axilayerai.com.
Enter your details, we will email the PDF immediately and include a short FDA/HIPAA crosswalk appendix.
Designed for heads of model risk, CCOs, and CROs at banks, broker-dealers, and insurers.
Designed for HR-tech platforms and employers in scope of LL 144.
An AI system is not a bridge or a pressure vessel. It is retrained, re-prompted, re-tooled, and re-pointed at new data on a timescale measured in days. The assessment cycle it sits inside is measured in years. Everything that happens in between is, under a purely periodic model, unobserved, and the certificate stays on the wall throughout.
The gap is not theoretical. In a production AI estate, the following are ordinary Tuesday events, none of them require a change-control board, and none of them are visible to an assessment that happened last March.
Accredited certification is the mechanism regulators recognize, and that is not changing, under the EU AI Act, most high-risk systems are assessed through the provider's own internal control, with a notified body where the Act requires one, and ISO/IEC 42001 certification runs through accredited certifiers. Continuous assurance is the layer underneath that cycle, not a substitute for it. Its job is to make sure that when the next assessment arrives, the evidence is already there, already dated, and already mapped to the framework it will be judged against, rather than being reconstructed from memory and screenshots in the three weeks beforehand.
That is also why our output is designed to be portable. Continuous evidence is structured to align with EU AI Act Annex IV technical documentation and ISO/IEC 42001 management-system requirements, so it can be handed to an internal audit function, an external assessor, or a certification body as an input to their process.
AxiLayer AI provides assessment, readiness support, and continuous monitoring. The Compliance Passport is a continuously updated attestation and evidence record, it is not an accredited certificate, a notified-body approval, or a regulatory authorization, and we do not present it as one.
Rules worldwide already run on clocks far shorter than an annual audit cycle. Only continuous evidence keeps pace with all of them.
AI-enabled devices may change after clearance only under a validated plan, with lifecycle monitoring. Source
EU financial entities must detect, classify and report ICT incidents on fixed clocks, including those involving AI services. Source
High-impact AI needs risk management across the whole lifecycle, not only at launch. Source
Calls for continuous monitoring and bounded permissions for AI agents. Source
U.S. bank supervisors keep ongoing monitoring as one of three core parts of model validation. Source
Automated driving systems need in-service monitoring and reporting after approval. Source
Post-market monitoring stays mandatory; Commission guidance and a template are due by 2 Sep 2027. Source
A dated, signed record showing when an issue appeared and what was done about it.
Evidence already mapped to ISO/IEC 42001 clauses and EU AI Act Annex IV, ready for the next audit.
A live status they can check before contract award, not a PDF from last year.
A current view of AI risk between audits, with every alert reviewed by a qualified AxiLayer AI auditor.
Status and dates reflect public sources reviewed in October 2026; confirm against official texts before relying on them.
Demand for AI is real in every regulated industry and on every continent. Yet a striking number of qualified AI vendors never clear procurement. The bottleneck is not capability. It is not budget. It is compliance readiness.
Regulated buyers operate under legal, regulatory, and risk frameworks of their own. Before any AI system can be evaluated, let alone contracted, it must show that its governance, data handling, audit trails, and algorithmic integrity meet the standards that risk, compliance, and legal teams require. Without evidence of that, procurement conversations do not progress.
The bottleneck in AI adoption is not demand. It is getting solutions through procurement and compliance gates, in every market.
Most vendors do not know exactly where they fall short, or how to document what they already do well. That gap, between building a strong AI product and proving its compliance fitness to a regulated buyer, is where significant contract value is lost every year.
AxiLayer AI is the AI control and assurance company. A qualified AxiLayer AI auditor who did not build the system signs each finding, and our fees never depend on a vendor's commercial outcome. Procurement teams and compliance officers receive evidence they can review.
We work within the frameworks regulated buyers increasingly reference: the EU AI Act, NIST AI RMF, ISO/IEC 42001, and ISO/IEC 23894, alongside the sector rules that apply in each segment and market.
Each segment has its own buyers, its own regulators, and its own evidence bar. Select yours for the detail.
The buyer gate: regulators now describe how AI must be governed across the medicines lifecycle, and sponsors pass that expectation to every vendor.
Hospital systems and device makers cannot place AI into clinical workflows without evidence that it is safe, explainable, and regulator-ready.
Banks, insurers, and asset managers require AI to survive model risk management, fair-lending, and supervisory examination.
Federal, state, and international public buyers hold AI vendors to an auditable standard for schedules, tenders, and framework agreements.
Defense and intelligence buyers require AI that is testable, explainable, resilient, and aligned with responsible-AI doctrine.
Enterprise CIOs, CISOs, and procurement teams now audit AI before they renew, expand, or sign.
Energy, water, transport, and telecom operators treat AI as a cyber-physical risk with sector-specific resilience regimes.
Law firms, legal departments, and courts apply a privilege-first lens to every AI tool they adopt.
Employment AI is among the most heavily regulated categories, and bias audits and disclosures are entry requirements.
Insurance AI sits under dedicated supervisory expectations for governance, fairness, and market conduct.
Personalization, pricing, and consumer-facing generative AI sit where privacy, consumer protection, and AI rules meet.
Districts, universities, and ministries evaluate AI against child-safety, privacy, pedagogy, and governance expectations.
The EU AI Act, NIST AI RMF, ISO/IEC 42001, and ISO/IEC 23894 are the common language buyers use in North America, Latin America, Europe, the Middle East, Africa, and Asia-Pacific. We build one evidence pack on that common language, then map it to the instruments that apply where you sell. Where a market's rules are still in draft, the finding says so.
Timelines move. Under the EU's AI Omnibus, published in the Official Journal in July 2026, obligations for Annex III high-risk AI systems now apply from 2 December 2027, obligations for AI embedded in Annex I regulated products from 2 August 2028, and Article 50 transparency obligations have applied since 2 August 2026, with Article 50(2) marking for legacy systems due by 2 December 2026. Vendors that document readiness now are not racing a deadline later.
A clear, structured path from uncertainty about your compliance posture to documented, review-ready evidence for regulated procurement channels.
We evaluate your AI system against the frameworks and rules that apply to your target buyers and markets, identifying gaps in governance documentation, risk controls, data handling, model transparency, and audit trail integrity before they become blockers in a procurement review.
Where gaps exist, we provide a structured remediation roadmap targeted to your system architecture, your data environments, and the specific requirements of your target buyers and markets.
Our auditors conduct a formal, documented review of your AI governance framework, including model validation records, risk registers, data provenance controls, and change management protocols. The audit is conducted by a qualified AxiLayer AI auditor who did not build the system.
Vendors who meet the assessment criteria receive a formal AxiLayer assessment finding along with a documentation package designed to be presented directly to procurement, risk, and legal teams.
Regulatory requirements evolve and change by market. We offer continuous monitoring agreements that track changes to applicable frameworks and alert vendors when their assessment evidence requires updating, supporting sustained market access, not a one-time review.
The documentation package is built once and mapped to what each buyer and regulator asks to see.
| Evidence | What it shows a buyer |
|---|---|
| Governance and accountability records | Who owns the AI system, who approves changes, and how decisions are escalated. |
| Risk register and impact review | Foreseeable harms, affected people, and the controls in place, mapped to NIST AI RMF and ISO/IEC 23894. |
| Data provenance and quality controls | Where training and operating data come from, and how quality, privacy, and bias are managed. |
| Validation, bias, and performance testing | Results against a defined context of use, with documented limits and deviations. |
| Human oversight and explainability | How people supervise outputs, override them, and understand why the system behaved as it did. |
| Security and change management | Controls over the model, its supply chain, updates, and incidents. |
| Monitoring and re-assessment plan | How the evidence stays current as regulations and the system change. |
No. We assess AI vendors in twelve segments, from pharma and healthcare to finance, government, defense, enterprise software, infrastructure, legal, HR, insurance, retail, and education. Many vendors sell into several and need one evidence pack that travels.
We assess against the common frameworks buyers use worldwide and map your evidence to the instruments that apply in your target markets. Where a country's rules are still in draft or not yet issued, the finding states that plainly instead of implying coverage.
A qualified AxiLayer AI auditor who did not build the system signs it. Fees never depend on the result.
Scope depends on your system, your target buyers, and the number of markets. Request an assessment and we will scope it with you before any commitment.
No. Our assessment findings are evidence for your buyers. They are not legal, regulatory, or compliance advice.
Start with a no-commitment Compliance Readiness Assessment. We will identify where your AI system stands today and what it takes to open regulated procurement channels in the markets you sell into.
Demand for AI in pharmaceutical and life sciences companies is real and accelerating, from regulatory submission automation and clinical trial technology to real-world evidence and pharmacovigilance. Yet many qualified AI vendors never clear procurement. The bottleneck is not capability or budget. It is compliance readiness.
Sponsors and manufacturers answer to regulators on every continent. Before an AI system is evaluated, it must show that its governance, data handling, audit trails, and algorithmic integrity meet the standards that quality, compliance, and legal teams require. Without evidence of that, procurement conversations do not progress.
Regulators have started to say how AI must be governed. Buyers now ask vendors to prove it.
The instruments below are the ones sponsors, manufacturers, and their auditors are reading in 2026. Statuses are shown as published; several are still drafts.
Draft guidance issued January 2025 (docket FDA-2024-D-4689). It sets out a risk-based credibility assessment framework in seven steps: define the question of interest and the context of use, assess model risk by model influence and decision consequence, plan and execute credibility activities, document results and deviations, and decide whether the model is adequate for its context of use.
Published jointly on 14 January 2026, covering early research, clinical trials, manufacturing, and safety monitoring. The agencies state the principles will inform future guidance in each jurisdiction.
Drafts were published for consultation in July 2025, and the consultation closed on 7 October 2025. In the draft, critical GMP applications are limited to static, deterministic models, with qualified personnel remaining responsible for decisions. The draft requires explainability analysis, confidence scoring where applicable, human oversight, and independence between training and test data. Generative AI and large language models are excluded from critical use in the draft. The PIC/S scheme joined the consultation.
Annex III high-risk obligations now apply from 2 December 2027, obligations for AI in Annex I regulated products from 2 August 2028, and Article 50 transparency obligations have applied since 2 August 2026, with Article 50(2) marking for legacy systems due by 2 December 2026.
The MHRA expanded its AI as a Medical Device sandbox with funding through 2029, launched a Medicines AI Sandbox in June 2026, and opened a call for evidence on AI regulation in healthcare that closed in February 2026.
Document GYJZ [2026] No. 6, dated 11 March 2026. It sets goals for 2030 and 2035 and seven focus areas, from intelligent review and approval to smart inspections, supported by data, computing, and cybersecurity foundations.
Issued 10 March 2026. It clarifies the roles of developers, deployers, and users, separates Clinical AI from Clinical-Ops AI, and addresses generative AI.
The Drugs Controller General announced a committee on how to evaluate, approve, and regulate AI in drug discovery on 18 September 2026. A formal scope has not been published.
Adopted in 2026 as a harmonized guideline on how modeling and simulation evidence is planned, evaluated, and documented.
Beyond these, AxiLayer tracks AI rules for pharma and life sciences in the other markets in our regulatory map and says plainly in each finding which instruments are in force, in draft, or not yet issued.
AxiLayer AI is the AI control and assurance company. We work within the EU AI Act, NIST AI RMF, ISO/IEC 42001, and ISO/IEC 23894, and we map evidence to the pharma-specific instruments above, including GxP data integrity expectations.
| What a sponsor asks for | Evidence we build with you |
|---|---|
| Context of use and model risk | A defined question of interest, context of use, and risk rating by model influence and decision consequence, in the shape of the FDA draft framework. |
| Credibility and validation | Validation plan, results, deviations, and an adequacy conclusion, with performance limits stated. |
| Explainability, confidence, oversight | Explainability analysis, confidence reporting where applicable, and documented human review that matches the Annex 22 draft controls. |
| Data provenance and independence | Source records, quality controls, and separation of training and test data with access control. |
| Management system and risk | AI management system records aligned to ISO/IEC 42001 and risk practice aligned to NIST AI RMF and ISO/IEC 23894. |
| Change control and monitoring | Versioning, release approval, drift monitoring, and a re-assessment schedule. |
We evaluate your AI system against the frameworks and rules that apply to your target buyers and markets, identifying gaps in governance documentation, risk controls, data handling, model transparency, and audit trail integrity before they become blockers in a procurement review.
Where gaps exist, we provide a structured remediation roadmap targeted to your system architecture, your data environments, and the specific requirements of your target pharma and life sciences buyers.
Our auditors conduct a formal, documented review of your AI governance framework, including model validation records, risk registers, data provenance controls, and change management protocols. The audit is conducted by a qualified AxiLayer AI auditor who did not build the system.
Vendors who meet the assessment criteria receive a formal AxiLayer assessment finding along with a documentation package designed to be presented directly to procurement, risk, and legal teams.
Regulatory requirements evolve and change by market. We offer continuous monitoring agreements that track changes to applicable frameworks and alert vendors when their assessment evidence requires updating, supporting sustained market access, not a one-time review.
We help pharma vendors document compliance readiness before they apply, not after they are asked to prove it.
Start with a no-commitment Compliance Readiness Assessment. We will identify where your AI system stands today and what it takes to open regulated procurement channels in the markets you sell into.
EMA, EMA and FDA set common principles for AI in medicine development. FDA, Considerations for the Use of AI To Support Regulatory Decision-Making for Drug and Biological Products. European Commission, Consultation on EudraLex Volume 4, Chapter 4, Annex 11 and new Annex 22. NMPA, Implementation Opinions on "Artificial Intelligence + Drug Regulation". UK government, AI Airlock. ICH, ICH M15 adoption. Singapore MOH and HSA, AI in Healthcare Guidelines 2.0 (March 2026). CDSCO committee announcement, 18 September 2026, as reported by the press.
Healthcare and MedTech AI vendors, including clinical decision support platforms, radiology and pathology AI, diagnostic algorithms, and AI/ML-enabled Software as a Medical Device (SaMD), face a compliance bar that is both clinical and regulatory. Hospital procurement, IRBs, and device regulators evaluate AI not only on performance but on governance, bias mitigation, post-market surveillance, and lifecycle accountability.
Without validation against frameworks such as the FDA Predetermined Change Control Plan (PCCP), the FDA Good Machine Learning Practice (GMLP) principles, the EU Medical Device Regulation (MDR) & IVDR, ISO 13485, ISO/IEC 42001, and HIPAA, conversations with compliance-led health systems stall before a contract is written.
We map your AI system against FDA AI/ML guidance, EU MDR/IVDR, ISO 13485, and ISO/IEC 42001, flagging gaps in clinical evidence, risk files, and post-market surveillance.
Validation of training data representativeness, subgroup performance, drift monitoring, and clinical safety signals across real-world populations.
Review of your quality management system, change-control under PCCP, design controls, and AI-specific risk management tied to ISO 14971 and IMDRF guidance.
A documentation package mapped to the exact evidence hospital IT security, compliance, and value-analysis committees require, BAA, HIPAA posture, algorithmovigilance, and explainability collateral.
Continuous monitoring of model drift, adverse events, and regulatory updates, because a clinical AI that was safe at launch is not automatically safe 12 months later.
The instruments below are the ones hospitals, device makers, and notified bodies are reading in 2026. Statuses are shown as published; several are still drafts.
Draft guidance issued January 2025 covering what to include in a marketing submission for AI-enabled device software functions, with lifecycle management, transparency, and bias considerations.
Final guidance issued December 2024 on pre-authorizing planned modifications to AI-enabled device software, so models can be updated without a new submission each time.
Final IMDRF document dated 27 January 2025 setting out ten guiding principles for good machine learning practice across the device lifecycle. It builds on the 2021 principles from FDA, Health Canada, and the MHRA.
Published 19 June 2025. A medical device AI system is high-risk under the AI Act when it is, or is a safety component of, a device that undergoes notified body conformity assessment. The guidance encourages one set of technical documentation and integrating AI Act requirements into the existing quality management system. Under the AI Omnibus, obligations for AI in Annex I regulated products now apply from 2 August 2028.
Issued 1 April 2026 for Class II, III, and IV machine learning-enabled devices. It covers predetermined change control plans, sex- and gender-based analysis (SGBA Plus) throughout the lifecycle, transparency in labeling and submissions, subgroup performance testing, clinical validation, and post-market monitoring plans.
The MHRA expanded its AI as a Medical Device sandbox with funding through 2029 and announced in June 2026 a regional sandbox letting up to ten AI device makers deploy in live NHS settings. Findings so far stress realistic deployment conditions, evolving human oversight standards, and clinically meaningful performance thresholds.
Consultation findings published 13 February 2026 describe a proposed exemption sandbox for lower-risk Class A and B AI medical software built by public healthcare institutions, with clinician oversight, annual quality self-attestation against ISO 13485, notification to HSA, and patient disclosure. The wider MOH and HSA AI in Healthcare Guidelines 2.0 followed in March 2026.
Released 14 and 15 September 2026. The first covers registration of Class II and III AI devices across the lifecycle, with emphasis on data governance, algorithm design, verification and validation, and cybersecurity, and it addresses large language models, federated learning, and transfer learning. The second requires per-disease clinical evidence for multi-disease auxiliary decision-making.
Which route applies depends on the device class and the market. Findings state plainly which instruments are in force, in draft, or not yet issued for each market you target.
Sources: FDA, Artificial Intelligence-Enabled Medical Devices; Federal Register notice of the draft guidance. IMDRF, GMLP guiding principles, N88 Final. European Commission, MDCG 2025-6. Health Canada, Pre-market guidance for machine learning-enabled medical devices. UK government, AI Airlock. Singapore HSA and NMPA items as reported in public press; confirm against the authority’s own text.
Start with a confidential Clinical AI Readiness Assessment. We will identify precisely what hospital CIOs, CMIOs, and regulators need to see before your system is deployed at the bedside.
AI in financial services operates inside one of the most mature model-governance regimes in the world. Credit decisioning, fraud detection, AML/KYC, algorithmic trading, robo-advisory, insurance pricing, and customer-facing generative AI are all treated as models, and models have to be validated by a third party, continuously monitored, and defensibly documented.
Vendors that cannot produce artifacts aligned with SR 26-2 / OCC Bulletin 2026-13 (U.S. model risk), the ECB Guide on Effective Risk Data Aggregation, the EBA Machine Learning Guidance for IRB Models, PRA SS1/23, and the EU AI Act are routinely filtered out of bank and insurer procurement before capability is even discussed.
Evaluation against SR 26-2, PRA SS1/23, OSFI E-23, and MAS FEAT, covering conceptual soundness, implementation, and outcomes analysis.
Testing for disparate impact, proxy discrimination, and explainability in regulated decisions, aligned with ECOA, Reg B, and CFPB Circular 2023-03.
Full IMV-grade audit of data lineage, feature engineering, challenger models, stress testing, and drift monitoring, defensible under supervisory examination.
An evidence pack structured for third-party risk management (OCC 2013-29, FFIEC IT Handbook), model inventories, and board-level AI governance reporting.
Ongoing monitoring aligned with quarterly and annual supervisory cycles, so your assessment record remains current across EU AI Act, Fed, OCC, FCA, PRA, BaFin, MAS, and HKMA expectations.
The instruments below are the ones banks, insurers, and their supervisors are reading in 2026. Statuses are shown as published; several are drafts or pending.
In the Official Journal on 24 July 2026 and in force from 27 July 2026. Annex III high-risk obligations, which include creditworthiness and life and health insurance pricing, now apply from 2 December 2027.
Dated 7 July 2026. Every significant institution under the Single Supervisory Mechanism must file an AI cyber action plan with its Joint Supervisory Team by 31 October 2026.
In force from 29 July 2026. BaFin is the market surveillance authority for financial-sector AI, with fining powers.
Issued 16 September 2026, built on NIST AI RMF. It looks for a documented AI inventory with a business owner and purpose, vendor contracts with audit rights, vendor confirmation on data provenance and explainability limits, human review, and periodic management reporting. The promised US interagency request for information on banks’ use of AI had not been issued as of 1 October 2026.
Both take effect on 1 May 2027 and include independent review requirements, with no validation grace period.
Issued 23 February 2026 and in force. It calls for annual bias testing, independent validation, model inventories, and contractual vendor audit rights.
Draft dated 24 June 2026. It states that a vendor’s own attestation does not discharge the regulated entity’s independent validation obligation.
Dated 30 April 2026. It states that second-line risk and internal audit need the technical capability and tooling to independently assess AI systems.
The consultation closed on 31 January 2026 and final guidelines are pending. The proposal calls for documentation sufficient for an independent reviewer or auditor to replicate the implementation.
The convergence that matters. Four requirements recur in nearly every instrument above: a complete inventory including purchased and embedded AI, independent validation scaled to risk, contractual audit and information rights over vendors, and continuous monitoring that produces an evidence record. One evidence program built that way presents in every one of these markets. In some markets, including Saudi Arabia, Bahrain, Brazil, and Mexico, we found no financial-sector AI instrument, and Japan has discussion papers only, so findings say so rather than implying a regime.
Still pending with no published dates: the final MAS guidelines, the final RBI circular, the US interagency request for information, and the FSB final sound practices report due in October 2026.
Sources: regulator and legislature publications as verified by AxiLayer AI on 1 October 2026. Confirm against the issuing authority before relying on them.
Start with a Model Risk & AI Governance Assessment designed for financial-services procurement.
Governments worldwide have moved AI from "innovation topic" to "regulated procurement category." In the United States, OMB M-25-21, Executive Order 14179, and the NIST AI RMF now govern how agencies acquire and use AI. In the EU, the EU AI Act classifies many public-sector deployments as high-risk. The UK AI Playbook, Canada's Directive on Automated Decision-Making, Singapore's Model AI Governance Framework, and Australia's AI Ethics Framework set similar expectations.
Vendors that cannot demonstrate conformity, bias controls, and documented accountability are increasingly non-viable in public tenders, regardless of product quality.
Gap analysis against OMB M-25-21, NIST AI RMF, EO 14179, and the EU AI Act's public-sector high-risk triggers.
Review of rights-impacting and safety-impacting AI classifications, including mandated impact assessments and public-transparency artifacts.
Review of FedRAMP alignment, CMMC posture, SBOM, and EO 14028 secure-software attestations relevant to public-sector AI deployments.
A documentation set aligned with FAR/DFARS AI clauses, state RFPs, and EU public-procurement AI annexes, ready to be submitted with your bid.
AI policy moves quickly at the federal level. We track changes across OMB, NIST, CISA, and international agencies so your assessment posture keeps pace.
The instruments below are the ones agencies, procurement offices, and public-sector buyers are reading in 2026. Statuses are shown as published; several are drafts or pending.
On April 3, 2025, OMB issued M-25-21 (Accelerating Federal Use of AI through Innovation, Governance, and Public Trust) and M-25-22 (Driving Efficient Acquisition of Artificial Intelligence in Government). M-25-21 requires Chief AI Officers within 60 days, annual public AI use case inventories, and documented minimum risk practices for high-impact AI within 365 days, with non-compliant high-impact AI discontinued. M-25-22 applies to contracts awarded under solicitations issued 180 days or more after issuance. It requires contract terms that permanently bar training public or commercial models on non-public agency data without consent, and that address data and model portability, licensing and pricing transparency, and vendor testing and validation procedures.
On December 11, 2025, OMB issued M-26-04 (Increasing Public Trust in Artificial Intelligence Through Unbiased AI Principles). Agencies had to update procurement policies by March 11, 2026, and new contracts issued after December 11, 2025 must carry the requirements, while existing contracts should be modified before option exercises. Vendors of large language models must supply an acceptable use policy, model, system or data cards, end user resources, and a mechanism for end user feedback, with further documentation on evaluation results and enterprise controls for enhanced transparency. The memo ceases to have force two years after issuance, and DOE Acquisition Letter AL 2026-05 of May 8, 2026 shows agencies applying it through an Ensuring Unbiased AI Principles (APR 2026) clause with annual re-verification.
On August 25, 2025, GSA and FedRAMP announced they would begin prioritizing 20x authorization of AI-based cloud services that give federal workers access to conversational AI engines for routine and repeated use. Qualifying offerings must be enterprise-grade with demonstrated government demand, be on the GSA Multiple Award Schedule, be able to complete authorization within two months of qualification, run on modern cloud infrastructure, and support automated validation of security posture. The full criteria are published at fedramp.gov/ai.
Texas H.B. 149 took effect January 1, 2026. Governmental entities that deploy AI intended to interact with consumers must give clear and conspicuous plain-language notice without dark patterns. Government entities are barred from social scoring that causes unjustified detrimental treatment and from biometric identification using internet-sourced data without consent where it violates legal rights. The Attorney General has exclusive enforcement with a 60-day cure period, and penalties run from $10,000 to $12,000 for curable violations and $80,000 to $200,000 for uncurable ones.
Regulation (EU) 2026/1744 of 8 July 2026 amends the AI Act (Regulation (EU) 2024/1689) and entered into force on 27 July 2026. It moves application of high-risk obligations to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I product-embedded systems. Article 111(2) of the AI Act, as shown on the European Commission AI Act Service Desk, requires providers and deployers of high-risk AI systems intended for use by public authorities to take the necessary steps to comply by 2 August 2030.
The Algorithmic Transparency Recording Standard is mandatory for all government departments and for arm's-length bodies that deliver public or frontline services or engage directly with the public, with a scope and exemptions policy published in December 2024 and the template and guidance updated in May 2025. The Government Digital Service published the AI Playbook for the UK Government on 10 February 2025 as guidance with ten principles. The Playbook tells buyers to require supplier transparency, to use a data ethics requirements checklist covering bias and interpretability, and to hold the same ethical expectations for procurement as for in-house builds.
The Treasury Board of Canada Secretariat amended the Directive on Automated Decision-Making effective April 25, 2023, with compliance deadlines of October 25, 2023 for new systems and April 25, 2024 for existing systems. It expanded scope to internal services such as hiring and security screening, and requires the Algorithmic Impact Assessment and peer review findings to be published before a system launches. The amendments also strengthened bias testing, data governance and system explanation measures. The mandatory Algorithmic Impact Assessment has 65 risk questions and 41 mitigation questions, yields impact levels I to IV, and its Government of Canada page was last modified September 15, 2026.
Version 2.0 of the DTA policy took effect on 15 December 2025 and applies to non-corporate Commonwealth entities. Agencies must designate accountable officials, keep internal registers of active and planned AI use, complete impact assessments using the DTA's 12-section template aligned to Australia's AI Ethics Principles, and publish transparency statements. The impact assessment implementation deadline is 15 December 2026, and the DTA has also issued guidance on AI procurement covering supplier due diligence and contract clauses.
The convergence that matters. Across the verified instruments, public buyers repeatedly require a documented impact or risk assessment before deployment (OMB M-25-21, Canada's Algorithmic Impact Assessment, Australia's DTA impact assessment), and a public or internal register of AI use (OMB inventories, the UK ATRS, Australian registers). They also converge on supplier transparency artifacts such as model cards, data ethics checklists and testing evidence (OMB M-26-04, UK AI Playbook), plus contract terms protecting government data and avoiding lock-in (OMB M-25-22). Human oversight, bias testing and plain-language notice to affected people recur in the US, Canadian, Texas and UK instruments.
We did not confirm a binding government AI procurement instrument for Singapore, the UAE, or Saudi Arabia, and findings say so rather than implying a regime.
Sources: each card links to the issuing authority where we could read its text. Cards labeled secondary rest on reputable secondary reporting and should be confirmed against the authority’s own text. Compiled by AxiLayer AI from public sources in early October 2026.
Get your compliance foundation assessed and signed by a qualified AxiLayer AI auditor before the RFP drops, not after the clarifications questions hit.
The DoD Responsible AI Strategy and Implementation Pathway, CDAO Responsible AI Toolkit, and the NATO Principles of Responsible Use for AI in Defence have elevated responsible-AI compliance from a slide deck to a contract requirement. U.S. Five Eyes partners (UK MoD JSP 936, Australia DoD Method for Ethical AI, Canada DND AI Ethics) run parallel regimes.
Defense and intelligence AI vendors that cannot demonstrate traceability of training data, adversarial-robustness testing, human-oversight controls, and mission-assurance artifacts risk losing position on classified and controlled contracts.
Alignment with DoD RAI SIP, NATO AI principles, NIST AI RMF, and service-component AI policies.
Review of T&E against ATEVV, adversarial testing, and red-teaming aligned with MITRE ATLAS and DoD RAI T&E guidance.
CMMC 2.0, NIST SP 800-171 / 800-53, SBOM, and software-supply-chain verification for classified-adjacent AI stacks.
An assessment artifact set structured for PEO, PM, and contracting-officer review, with direct linkage to DFARS and CDAO RAI toolkit requirements.
Ongoing monitoring of model performance, threat surface, and doctrine updates so responsible-AI conformity is maintained through the full mission lifecycle.
The instruments below are the ones defense ministries, prime contractors, and acquisition authorities are reading in 2026. Statuses are shown as published; several are drafts or pending.
Signed June 5, 2026, NSPM-11 rescinds and replaces National Security Memorandum 25 and organizes policy around adoption, adaptation, assurance and accountability. It directs updates to DoD Directive 3000.09 and an AI governance policy for national security systems within 90 days, and procurement changes for rapid multi-vendor model onboarding and standardized test and evaluation methods within 120 days. It also requires AI systems to be reliable, robust, steerable and controllable and protected from unauthorized disabling or modification, and it lets agencies terminate contracts with companies that repeatedly show conduct inconsistent with the policy, with limited waivers.
Reissued January 25, 2023 (original issuance November 21, 2012), the directive requires that commanders and operators can exercise appropriate levels of human judgment over the use of force. It requires senior-level review for covered autonomous weapon systems, hardware and software verification and validation with realistic operational testing, operator procedures to activate, deactivate and override, and alignment with the DoD AI Ethical Principles. NSPM-11 ordered a revision within 90 days of June 5, 2026, and a June 12, 2026 Senate letter confirms the 2023 text remained the operative policy while that revision was pending; no published revision was found as of early October 2026.
Released July 10, 2024, the revised strategy updates NATO's 2021 strategy to address generative AI and frontier models. It restates the six Principles of Responsible Use: lawfulness, responsibility and accountability, explainability and traceability, reliability, governability, and bias mitigation. It sets four aims: lead by responsible example, accelerate adoption, protect allied AI technologies, and counter adversarial AI use, with emphasis on interoperability and industry partnership.
Version 1.1, published November 2024, is owned by the Ministry of Defence through the Defence AI and Autonomy Unit and the Defence AI Centre. It embeds five ethical principles (human-centricity, responsibility, understanding, bias and harm mitigation, reliability), requires context-appropriate human involvement for meaningful human control, and ties approval to risk classification from minor to critical, with critical cases going to the 2nd Permanent Under Secretary or Ministers. It treats development as a shared endeavor between MOD and its suppliers, who must provide assurance that commercial technologies are safe, reliable and consistent with those principles.
The Regulation was adopted June 13, 2024 and published in the Official Journal on July 12, 2024. Article 2(3) excludes AI systems placed on the market, put into service or used exclusively for military, defense or national security purposes, and Recital 24 addresses dual-use systems. A system sold for both military and civilian use can fall back into scope when it is used for civilian purposes, so the exclusion does not cover dual-use products.
Published in March 2026, the policy requires lawful AI use under domestic and international law, including Article 36 legal reviews of weapon systems, and an identifiable Accountable Officer for each AI capability. It sets values-based principles (accountable, explainable, bias-mitigating, human-centric, reliable and secure) and proportionate controls such as testing, evaluation and post-incident review. It applies to suppliers involved in research, design, development, deployment, use and decommissioning, with compliance governed through the Defence Artificial Intelligence Centre.
Formulated June 6, 2025 by the Ministry of Defense, the guidelines classify equipment as high or low risk by AI influence on destructive capability and apply a Legal and Policy Review Board and a Technical Review Board. Development is not permitted if the system qualifies as a fully autonomous lethal weapon without human involvement, and compliance with international humanitarian law must be ensurable. The Technical Review Board assesses seven requirements including human responsibility, operator understanding, bias mitigation, verifiability, reliability and safety. The Minister stated one purpose is to help businesses understand expectations when joining defense equipment R&D projects.
Released March 7, 2024 as the first DND/CAF AI strategy, it sets five lines of effort including ethics, safety and trust and partnerships with industry and academia. It requires AI to augment human decision-making with humans central to any use of force, decisions to be explainable and transparent with accountability mechanisms, and Gender-Based Analysis Plus applied across initiatives. It also commits to faster procurement with Public Services and Procurement Canada, supply chain security and export control considerations, and alignment with the Directive on Automated Decision-Making.
The convergence that matters. Across the United States, NATO, United Kingdom, Australia, Japan, and Canada, buyers repeat the same core asks: human judgment or control over use of force, traceability and explainability, reliability shown through lifecycle testing, and bias mitigation. Accountability is increasingly assigned to named people or review bodies, such as senior reviewers, accountable officers, and review boards, and suppliers are pulled into that chain through assurance evidence. The newest US instrument adds demands for controllability and protection against unauthorized modification, which an assessment can test.
Some markets, South Korea among them, have no published defense ministry instrument on responsible military AI that we could confirm, and findings say so.
Sources: each card links to the issuing authority where we could read its text. Cards labeled secondary rest on reputable secondary reporting and should be confirmed against the authority’s own text. Compiled by AxiLayer AI from public sources in early October 2026.
Get your responsible-AI evidence package assessed and signed by a qualified AxiLayer AI auditor before PM review, so your technical proposal is not held up by an ethics annex.
Enterprises no longer take AI vendor claims at face value. Third-party risk management programs now include dedicated AI due-diligence questionnaires, GPAI disclosures, and annual attestations. Customers in regulated industries (financial, healthcare, public sector, critical infrastructure) cascade their own regulatory obligations into your contract.
Enterprise SaaS vendors that arrive at renewal without ISO/IEC 42001 alignment, SOC 2, NIST AI RMF mapping, and EU AI Act GPAI documentation increasingly face delayed renewals or displacement.
Gap analysis against ISO/IEC 42001, NIST AI RMF, and the EU AI Act, tailored to SaaS and GPAI deployment patterns.
Structured mapping of what you must disclose to downstream deployers under the EU AI Act, the UK AI regulatory principles, and Colorado SB 26-189.
Integrated review of SOC 2, ISO/IEC 27001, ISO/IEC 27701, GDPR, and AI-specific controls, so a single audit cycle covers what enterprise procurement actually asks for.
A procurement-ready evidence pack aligned with the CAIQ, SIG Lite AI, TPSN AI, and industry vertical questionnaires enterprise buyers now circulate.
Ongoing monitoring so that at every renewal cycle, your AI conformity evidence is current, and customer security and legal teams have no reason to reopen the contract.
The instruments below are the ones enterprise buyers, procurement teams, and their counsel are reading in 2026. Statuses are shown as published; several are drafts or pending.
Providers of general-purpose AI models have had to meet the AI Act transparency and copyright obligations since 2 August 2025, and models already on the market before that date must comply by 2 August 2027. Providers must keep technical documentation for downstream providers, maintain a copyright policy and publish a summary of training content, with added risk assessment, incident reporting and cybersecurity duties for systemic-risk models. The Commission published its GPAI provider guidelines on 18 July 2025 and the voluntary GPAI Code of Practice (Transparency, Copyright, and Safety and Security chapters) on 10 July 2025. The AI Office can fine up to 3% of global annual turnover or EUR 15 million, whichever is higher.
Regulation (EU) 2026/1744 was adopted on 8 July 2026, published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It moves AI Act obligations for stand-alone Annex III high-risk systems to 2 December 2027 and for Annex I product-embedded systems to 2 August 2028. Providers of generative systems placed on the market before 2 August 2026 have until 2 December 2026 to mark synthetic audio, video, image and text outputs.
Governor Polis signed SB 26-189 on 14 May 2026, and it takes effect on 1 January 2027, replacing the original Colorado AI Act (SB 24-205). Developers must give deployers documentation on intended uses, training data categories, known limitations and risks, while deployers must give consumers notice before a consequential decision and a plain-language explanation within 30 days of an adverse outcome. Records must be kept for three years. The Colorado Attorney General enforces exclusively, with a 60-day cure period and no private right of action.
TRAIGA took effect on 1 January 2026. It bars developing or deploying AI systems intended to incite self-harm or crime, to produce child sexual abuse material or sexualized impersonation of minors, or to unlawfully discriminate against protected classes, and it requires government entities to disclose AI interactions to consumers. The Texas Attorney General has exclusive enforcement authority, with a 60-day cure period and civil penalties from $10,000 to $12,000 for curable violations and from $80,000 to $200,000 for uncurable ones. Substantial compliance with the NIST Generative AI Profile is an affirmative defense, and a sandbox allows testing for up to 36 months.
The California Privacy Protection Agency announced the finalized regulations on 23 September 2025, with a general effective date of 1 January 2026. Businesses must meet the automated decisionmaking technology (ADMT) requirements by 1 January 2027 and begin risk assessments on 1 January 2026, with the attestation and summary due by 1 April 2028. Cybersecurity audits are phased by revenue, due 1 April 2028 for businesses over $100 million, 1 April 2029 for $50 million to $100 million and 1 April 2030 below $50 million.
The AI Basic Act and its Enforcement Decree took effect on 22 January 2026, after the Ministry of Science and ICT ran a legislative notice from 12 November to 22 December 2025. Providers of products or services using high-impact or generative AI must notify users in advance that AI is being used. The Ministry has said it will apply a grace period of at least one year before administrative fines take effect.
Japan's first dedicated AI law, the Act on Promotion of Research and Development and Deployment of AI-related Technology (Act No. 53 of 2025), passed the Diet on 28 May 2025 and sets basic principles without monetary penalties. The Cabinet adopted Japan's Second Artificial Intelligence Basic Plan on 14 July 2026 under Article 18, paragraph 1 of the Act. The plan calls for responsible agile governance, integrated risk mitigation across technical, social and national security risks, and voluntary and proactive steps by businesses, with the AI Safety Institute evaluating models.
The Infocomm Media Development Authority launched the framework on 22 January 2026 for organizations building or adopting AI agents. It sets four dimensions: assess and limit agent risks upfront, make humans accountable through approval checkpoints, apply technical controls across the agent lifecycle, and enable end-user responsibility through transparency and training. The framework is voluntary and recommends measures rather than imposing legal requirements.
ISO/IEC 42001:2023, the first AI management system standard, was published on 18 December 2023 and applies a Plan-Do-Check-Act approach to AI governance, traceability, transparency and reliability. NIST released AI RMF 1.0 on 26 January 2023 and the Generative AI Profile (NIST AI 600-1) on 26 July 2024. Buyers cite both as baselines, and Texas names substantial compliance with the NIST Generative AI Profile as an affirmative defense.
The convergence that matters. Documentation passed to downstream customers recurs in the EU GPAI rules and Colorado SB 26-189, and risk assessments recur in the California CPPA regulations, Singapore's agentic framework and ISO/IEC 42001. Notice that AI is in use, and labeling of generated content, recurs in the EU Article 50 rules and the Korean AI Basic Act. Human oversight and recordkeeping run through Colorado, Singapore and the standards, and the NIST framework is written into Texas law as a defense, so one evidence file can serve several buyers.
In the United Kingdom, Canada, and Brazil we did not confirm a binding AI-specific instrument in force, and proposals continue to move, so findings state the status for each market you target.
Sources: each card links to the issuing authority where we could read its text. Cards labeled secondary rest on reputable secondary reporting and should be confirmed against the authority’s own text. Compiled by AxiLayer AI from public sources in early October 2026.
Start with an AI Governance Readiness Assessment designed for SaaS renewal and expansion cycles.
Operators of critical infrastructure answer to sector regulators with teeth: NERC CIP, TSA Security Directives, EU NIS2, the EU Critical Entities Resilience (CER) Directive, ISA/IEC 62443, and national equivalents such as Ofgem, Ofcom, and BNetzA. Adding AI to SCADA, OT, grid-balancing, predictive-maintenance, or fleet-routing workflows triggers additional scrutiny, not less.
Vendors that cannot evidence AI conformity alongside OT security posture are regularly screened out during sector supply-chain reviews, especially post-Colonial Pipeline, post-SolarWinds, and under NIS2 supply-chain accountability.
Gap mapping against NERC CIP, TSA SDs, NIS2, CER, ISA/IEC 62443, and your target operator's cyber-physical AI policy.
Review of how AI interacts with OT perimeters, safety-instrumented systems, and fail-safe modes.
Supplier-risk review consistent with NIS2 Article 21 supply-chain obligations and CISA Secure-by-Design expectations.
A documentation pack built for utility cybersecurity teams, TSOs/DSOs, and national competent authorities.
Tracking of sector-regulator updates (FERC, NERC, TSA, CISA, ENISA, ACER) and automatic flagging when your assessment posture must be updated.
The instruments below are the ones operators of energy, water, transport, and telecom networks, and their regulators are reading in 2026. Statuses are shown as published; several are drafts or pending.
Published December 3, 2025 by CISA with NSA's AI Security Center, FBI, Australia's ASD ACSC, the Canadian Centre for Cyber Security, Germany's BSI, NCSC-NL, NCSC-NZ and NCSC-UK. It sets four principles: understand AI, consider AI use in the OT domain (including data security and vendor roles), establish AI governance and assurance frameworks with rigorous testing, and embed human oversight and failsafe practices. Operators are told to integrate AI only where clear benefits outweigh the risks.
Published September 28, 2023, this revision widens scope from industrial control systems to OT that interacts with the physical environment across critical infrastructure. It covers OT architectures, threats, vulnerabilities, safeguards and risk management. It also provides tailored security control baselines for low, moderate and high impact systems while addressing OT performance, reliability and safety needs.
Annex III point 2 classifies as high-risk the AI systems intended as safety components in the management and operation of critical digital infrastructure, road traffic, or the supply of water, gas, heating or electricity. Regulation (EU) 2026/1744 of 8 July 2026 amends Regulation (EU) 2024/1689 and entered into force July 27, 2026. Annex III high-risk rules now apply from December 2, 2027, and Annex I product-embedded high-risk rules from August 2, 2028.
Entered into force in January 2023, with a Member State transposition deadline of October 17, 2024, replacing NIS1 from October 18, 2024. It covers sectors including energy, transport, water, digital infrastructure and public electronic communications. Medium and large entities must adopt cybersecurity risk-management measures, address supply chain security, notify significant incidents to national authorities, and management is held accountable for non-compliance.
Manufacturer reporting obligations began September 11, 2026 through ENISA's CRA Single Reporting Platform. Manufacturers must report actively exploited vulnerabilities and severe incidents affecting product security, with an early warning within 24 hours, a full notification within 72 hours, a final vulnerability report within 14 days after a corrective measure is available, and a final incident report within one month of the 72-hour notification. Open-source software stewards follow from December 11, 2027.
Introduced November 12, 2025, with Commons Second Reading on January 6, 2026, and Lords Committee stage completed September 7, 2026. It had not received Royal Assent at the time of writing. It amends the Network and Information Systems Regulations 2018 to extend oversight to data centers, large load controllers, managed service providers and critical suppliers, update incident reporting, raise regulator penalties and let the Secretary of State issue national security directions.
Covers 11 sectors including energy, transport, water and sewerage, and communications. All covered assets must supply data to the Register of Critical Infrastructure Assets, report cyber incidents to the Australian Cyber Security Centre, and adopt and comply with a written risk management program. Systems of National Significance also face four enhanced obligations: incident response planning, cyber exercises, vulnerability assessments and system information provision. The CISC page notes the regulatory posture evolving from 2026 to 27 following the 2026 Independent Review.
On July 22, 2026 the CSA announced an updated Cybersecurity Code of Practice for CII and a new Code of Practice for Cloud Services, both due in the second half of 2026. The update responds to AI-enabled threats and adds technical direction on adversarial attack simulation, penetration testing and threat hunting. CII owners face stronger board oversight with a documented cyber resilience framework reviewed annually, monitoring of interconnected systems and threat detection across network segments.
Received Royal Assent June 15, 2026 as An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts. Designated operators in finance, telecommunications, energy and transportation must establish a cyber security program within 90 days of joining a regulated class and report cyber incidents to the Communications Security Establishment within a period not to exceed 72 hours. They must also reduce and supply chain risks and keep records, while regulators can inspect and issue compliance orders. Telecommunications Act amendments took effect on Royal Assent and the new Act rolls out in phases.
The convergence that matters. Across the verified instruments, operators are being pushed to run documented risk management programs that reach into their supply chain, which makes vendor evidence a purchasing input. Incident and vulnerability reporting windows are short, measured in hours or days, in instruments such as the Cyber Resilience Act and NIS2. Human oversight, testing, and failsafe design for AI in OT recur in the CISA joint guidance, NIST SP 800-82 Revision 3, and the EU AI Act Annex III point 2 treatment of safety components.
We found no binding instrument written specifically for AI in operational technology in US federal rules, the United Kingdom, Australia, or Singapore, so operators rely on general cyber and resilience law plus the joint guidance.
Sources: each card links to the issuing authority where we could read its text. Cards labeled secondary rest on reputable secondary reporting and should be confirmed against the authority’s own text. Compiled by AxiLayer AI from public sources in early October 2026.
Start with a sector-specific Readiness Assessment designed around operator cyber-physical risk reviews.
Legal AI vendors, eDiscovery, contract lifecycle, legal research, drafting copilots, and court-adjacent analytics, are evaluated against ABA Model Rules 1.1 (competence), 1.6 (confidentiality), 5.3 (nonlawyer assistance), and ABA Formal Opinion 512 on generative AI. In the EU, the EU AI Act designates administration-of-justice AI as high-risk. State bar opinions (California, Florida, New York, Texas) add further guardrails.
Law-firm and general-counsel buyers are now routinely asking vendors for documented evidence that privilege is preserved, training data is appropriately scoped, and outputs meet professional-responsibility standards.
Mapping of your AI system to ABA Model Rules, Opinion 512, state-bar opinions, and SRA/BSB standards in the UK.
Assessment of data segregation, tenant isolation, training-data scoping, and output-logging, aligned with BAA-equivalent confidentiality expectations.
Structured evaluation of RAG pipelines, source-grounding, and citation verification, the very failure modes courts and bars are sanctioning.
A documentation pack mapped to ILTA, ACEDS, and leading AmLaw firm AI-vendor questionnaires.
Tracking of state-bar, ABA, SRA, and judicial AI policies so your assessment record stays ahead of changing professional-responsibility standards.
The instruments below are the ones courts, bar regulators, and law firms are reading in 2026. Statuses are shown as published; several are drafts or pending.
The ABA Standing Committee on Ethics and Professional Responsibility issued Formal Opinion 512 on July 29, 2024. It applies the Model Rules to lawyers' use of generative AI. Competence (Rule 1.1) requires understanding the capabilities and limits of the tools and refreshing that understanding over time. Confidentiality (Rule 1.6) requires specific client consent before confidential information is entered into a tool, and the opinion states that boilerplate engagement-letter consent is not adequate. Supervisory lawyers (Rules 5.1 and 5.3) must set clear policies on permissible use and train lawyers and staff.
The State Bar's Standing Committee on Professional Responsibility and Conduct (COPRAC) approved proposed amendments to Rules 1.1, 1.4, 1.6, 3.3, 5.1 and 5.3 on March 13, 2026 for public comment, which closed May 4, 2026. The proposals would require lawyers to independently review and verify AI-generated work product and confirm that no cited authority is fabricated or misstated. They would also treat exposing confidential information to a technological system that creates a material risk of inconsistent use as a revealing of that information. They would require firm-level AI policies and client communication when AI materially affects scope, cost or manner of the work. No adoption date has been published, and the California Supreme Court has final authority.
Proposed Rule 707 would apply the Rule 702 reliability standards to machine-generated evidence offered without an expert witness. It was published for public comment in 2025, and the comment period closed February 16, 2026. On May 7, 2026, the Advisory Committee on Evidence Rules did not advance or republish the rule. It deferred Rule 707, together with proposed Rule 901(c) on deepfakes, to its Fall 2026 meeting (October 15, 2026), with a mini-conference of technical experts and litigators. No rule is in effect.
The Courts and Tribunals Judiciary of England and Wales published updated Artificial Intelligence (AI) Judicial Guidance on October 31, 2025. It covers an expanded glossary, risks such as bias and hallucinations, a warning against entering private information into public AI tools, and reporting of data incidents. It applies to judicial office holders and their support staff. In Ayinde v London Borough of Haringey, decided June 6, 2025, the Divisional Court held that lawyers using AI for legal research have a professional duty to check its accuracy, and it referred the lawyers involved to their regulators. The court also said it expects heads of chambers and managing partners to take practical measures so their lawyers understand these duties.
Annex III point 8 classifies AI systems used by or for judicial authorities to research and interpret facts and law, or used similarly in alternative dispute resolution, as high-risk. Regulation (EU) 2026/1744 (AI Omnibus), dated July 8, 2026, entered into force on July 27, 2026. Law firm summaries report that it moved the application date for stand-alone Annex III high-risk obligations from August 2, 2026 to December 2, 2027. Providers must then meet requirements including risk management, data governance, technical documentation, human oversight and EU database registration.
The Council of Bars and Law Societies of Europe published its Guide on the Use of Generative AI by Lawyers on October 2, 2025. It flags unauthorized data retention, hallucinations, bias, lack of transparency, intellectual property uncertainty and cybersecurity risk. It ties these to confidentiality, competence with independent verification of outputs, independence and transparency toward clients. A separate CCBE technical guide dated March 27, 2026 compares on-premises, colocation, IaaS and fully managed SaaS deployment, and says confidentiality depends on the deployment model and on contract terms covering training use, personnel access and law enforcement cooperation.
The Federal Court's Notice to the Parties and the Profession, first published December 20, 2023 according to a law firm summary, requires a declaration in the opening paragraph of a court document when generative AI was used to create its content. It also asks counsel to keep a human in the loop and to confirm that AI-derived legal references come from well-recognized and reliable sources. The Court's page confirms an updated notice, with the page last modified November 18, 2024. Separately, the Canadian Judicial Council issued Guidelines for the Use of Artificial Intelligence in Canadian Courts on October 24, 2024, stating that judicial decision-making cannot be delegated to AI.
Registrar's Circular No. 1 of 2024 issued the Guide on September 23, 2024, effective October 1, 2024. Court users are fully responsible for all content in their court documents. They may not use generative AI to generate evidence they wish to rely on, must prevent unauthorized disclosure of confidential information, and must independently verify outputs, since one AI tool cannot be used to confirm another's output. A pre-emptive declaration of AI use is not required unless the Court asks for one.
Chief Justice Bell issued Practice Note SC Gen 23 on January 28, 2025, with effect from February 3, 2025. Generative AI may not be used to create the substance of affidavits, witness statements or character references, and those documents must carry a disclosure confirming it was not. Expert reports generally need leave of the Court, with disclosure of the program, version and prompts used. Authors must personally verify that all citations and authorities exist, are accurate and are relevant, and privileged or suppressed material may not be entered into a tool unless the platform keeps data controlled and out of model training.
The convergence that matters. Confidentiality and independent verification of AI outputs recur in every verified instrument, including the ABA opinion, the CCBE guide, the Singapore and NSW court documents, the Canadian notice and the UK guidance. Supervision and firm-level policy duties appear in ABA Opinion 512, the proposed California rules and the UK Divisional Court judgment. Disclosure is where the instruments diverge: NSW and Canada require a statement in specified documents, Singapore requires one only if the court asks, and the ABA opinion ties disclosure to client communication.
We did not confirm a court or bar instrument on generative AI for Japan or the Gulf, so findings do not assume one.
Sources: each card links to the issuing authority where we could read its text. Cards labeled secondary rest on reputable secondary reporting and should be confirmed against the authority’s own text. Compiled by AxiLayer AI from public sources in early October 2026.
Start with a Legal-AI Readiness Assessment structured around privilege, professional-responsibility, and court-adjacent obligations.
Recruiting, talent-assessment, performance-analytics, and workforce-monitoring AI are regulated as high-risk under the EU AI Act (Annex III Employment), by NYC Local Law 144 (AEDT bias audits), Illinois AI Video Interview Act, Colorado SB 26-189, EEOC technical assistance on AI, the UK Worker Information & Consultation regime, GDPR Article 22, and similar frameworks in Singapore and Korea.
Vendors without a bias-audit record and governance documentation are increasingly excluded from enterprise HR stacks outright.
Gap analysis against EU AI Act high-risk obligations, NYC LL 144, Illinois AIVIA, Colorado SB 26-189, and EEOC guidance.
Disparate-impact and selection-rate testing consistent with NYC Local Law 144, the Uniform Guidelines on Employee Selection Procedures, and EEOC technical assistance.
Review of disclosures, opt-outs, and appeal mechanisms required under Colorado, Illinois, California, and GDPR Article 22.
A documentation pack aligned with HR-vendor diligence, works-council consultation, and data-protection-officer review.
Employment-AI rules are spreading fast. We track new state, federal, and international obligations so your assessment record and disclosures stay current.
The instruments below are the ones employers, regulators, and their counsel are reading in 2026. Statuses are shown as published; several are drafts or pending.
The NYC Department of Consumer and Worker Protection has enforced the law since July 5, 2023. Employers and employment agencies may not use an automated employment decision tool unless it had a bias audit within one year of use, audit information is public, and required notices were given to candidates and employees 10 business days before use. A December 2, 2025 audit by the Office of the New York State Comptroller (report 2024-N-6) found enforcement ineffective, citing at least 17 instances of potential non-compliance in a 32-company sample where DCWP found one.
Effective January 1, 2026, Illinois employers may not use AI that has the effect of discriminating on the basis of protected classes in recruitment, hiring, promotion, discipline, tenure or other employment terms. Employers must notify applicants and employees when AI is used in those decisions, and zip codes may not be used as a proxy for protected classes. The Illinois Department of Human Rights proposed notice rules, then on June 2, 2026 temporarily postponed rulemaking and canceled its June 10 hearing with no new timeline.
Governor Polis signed SB26-189 on May 14, 2026, replacing the 2024 Colorado AI Act, and it applies to consequential decisions, including employment, made on or after January 1, 2027. Deployers must give notice of automated decision-making technology use and, within 30 days of an adverse outcome, a plain-language description of its role. Developers must give deployers technical documentation, and the Attorney General must adopt implementing rules by January 1, 2027 and enforces under the state deceptive trade practices law.
The California Civil Rights Council's modifications to its employment regulations were approved by the Office of Administrative Law and filed June 27, 2025, and took effect October 1, 2025. They apply anti-discrimination rules to automated-decision systems that make or facilitate employment decisions. Law firm summaries report that anti-bias testing evidence is relevant to liability, that third parties performing recruitment or screening for an employer can be treated as agents, and that employment and ADS records must be kept four years.
The California Privacy Protection Agency's final CCPA regulations on automated decisionmaking technology, risk assessments and cybersecurity audits took effect January 1, 2026, with automated decisionmaking compliance due January 1, 2027. For significant decisions covering hiring, work allocation, compensation, promotion, demotion, suspension and termination, covered businesses must give pre-use notice, honor opt-out rights subject to exceptions, explain the logic and outcome on request, and complete risk assessments. Law firm summaries report an exemption where meaningful human involvement exists.
Regulation (EU) 2026/1744 of July 8, 2026 entered into force July 27, 2026 and moves application of the AI Act Annex III high-risk obligations from August 2, 2026 to December 2, 2027. Annex III point 4 covers AI used for recruitment and selection, promotion, termination, task allocation and performance monitoring. Providers must meet risk management, data governance, human oversight and transparency requirements, and deployers must inform workers when high-risk AI affects them.
The directive was adopted October 23, 2024 and Member States must transpose it by December 2, 2026. Chapter III bars digital labour platforms from using automated systems to monitor workers' emotional or psychological state or to predict the exercise of fundamental rights, and requires information to workers about automated systems. Decisions to restrict, suspend or terminate an account must be made by humans, with written explanation and a review request within two weeks, and platforms must evaluate algorithmic impacts every two years.
Section 80 replaces UK GDPR Article 22 with Articles 22A to 22D and has applied to decisions taken on or after February 5, 2026. Significant decisions based on special category data cannot be made solely by automated means without explicit consent or another listed condition, and controllers must provide information, enable representations, human intervention and contestation. On March 31, 2026 the ICO published its Recruitment Rewired report and draft automated decision-making guidance, with consultation open until May 29, 2026, expecting bias monitoring, transparency to jobseekers and explained routes to human review.
Effective January 1, 2026, employers with 25 or more employees must state in publicly advertised job postings whether artificial intelligence is used to screen, assess or select applicants. The regulation defines artificial intelligence as a machine-based system that infers from inputs to generate outputs such as predictions, recommendations or decisions. Employers must keep copies of postings and application forms for three years after the posting is removed, and law firm summaries report fines of up to $100,000 for corporations on conviction.
The convergence that matters. Candidate or worker notice recurs across New York City, Illinois, Colorado, California privacy regulations, EU deployer duties, the UK ICO expectations and Ontario job postings. Bias testing or monitoring appears in the NYC bias audit, California anti-bias testing evidence, the ICO's recruitment expectations and the Platform Work Directive impact evaluation. Human review or contest rights appear in Colorado, the California privacy appeal and human involvement provisions, UK Article 22C, EU high-risk human oversight and Platform Work Directive Article 11.
Federal technical assistance on AI hiring tools in the United States is limited at present, so state and city rules carry most of the weight. Australia, Singapore, and India have not yet been assessed for this segment.
Sources: each card links to the issuing authority where we could read its text. Cards labeled secondary rest on reputable secondary reporting and should be confirmed against the authority’s own text. Compiled by AxiLayer AI from public sources in early October 2026.
Start with an HR-AI Readiness Assessment and a bias audit aligned to the jurisdictions where your buyers operate.
The NAIC Model Bulletin on the Use of AI by Insurers, now adopted in more than 20 U.S. states, sits alongside Colorado Regulation 10-1-1 on life-insurance AI, New York DFS Circular Letter 2024-7, EIOPA AI Governance Principles, and UK FCA SS1/23 model-risk guidance. The EU AI Act designates life and health insurance underwriting and pricing AI as high-risk.
Insurance carriers cascade these obligations directly to their AI vendors. Without assessment, InsurTech contracts stall at legal, actuarial, and market-conduct review.
Gap mapping against NAIC Model Bulletin, Colorado 10-1-1, NY DFS CL 2024-7, EIOPA AI Governance Principles, and the EU AI Act.
Testing for unfair-discrimination and protected-class outcomes, aligned with state insurance-department expectations.
Review of ASOP 56-adjacent model-risk controls, board-level AI governance, and third-party data-source accountability.
A documentation set structured for chief actuary, chief compliance officer, market-conduct examiners, and EIOPA-supervised entities.
State-by-state and country-by-country monitoring as NAIC, EIOPA, and national regulators continue to expand AI-specific insurance supervision.
The instruments below are the ones insurers, insurance supervisors, and their regulators are reading in 2026. Statuses are shown as published; several are drafts or pending.
The NAIC adopted the model bulletin on December 4, 2023. It expects insurers to keep a written AI Systems Program with senior management and board accountability, third-party vendor due diligence (including data sources, bias testing and audit rights), and documentation of testing and monitoring. The NAIC implementation map, status as of August 31, 2026, shows about two dozen jurisdictions adopting the bulletin or a version of it, while California, Colorado, New York and Texas rely on their own instruments.
The NAIC Third-Party Data and Models (H) Working Group exposed this draft at its July 8, 2026 interim meeting, with public comments due August 5, 2026. It would set a regulatory framework for vendors of data and models used in property and casualty pricing and underwriting. The draft includes a voluntary multistate registry where vendors provide governance information and identify the insurers that use their data or models.
The Colorado Division of Insurance amended Regulation 10-1-1, effective October 15, 2025, extending it from individually issued life insurance to private passenger automobile insurance and health benefit plans. Insurers must run a risk-based governance framework with board oversight and documentation across design, testing, deployment and monitoring of external consumer data and algorithms, and they remain responsible when vendors supply data or models. Frameworks must include the quantitative testing set by the Division to detect unfair discrimination. Auto and health insurers owed progress reports on December 1, 2025 and compliance reports on July 1, 2026 and annually after.
The New York Department of Financial Services issued the final circular letter on July 11, 2024, after a January 2024 draft. It applies to insurers licensed in New York that use artificial intelligence systems and external consumer data and information sources in underwriting and pricing. It sets expectations for governance, oversight of third-party vendors, testing for unfair discrimination and documentation of AI use.
The AI Omnibus entered into force on July 27, 2026 and sets December 2, 2027 as the application date for Annex III high-risk systems (August 2, 2028 for Annex I systems). Annex III point 5(c) classifies AI systems intended for risk assessment and pricing in relation to natural persons in life and health insurance as high-risk. Vendors of such systems therefore face high-risk obligations from December 2, 2027.
EIOPA published the Opinion on August 6, 2025, together with an Impact Assessment, after a public consultation. It is addressed to national supervisors and covers insurance undertakings and intermediaries using AI systems, with particular focus on AI that is not high-risk. It applies a risk-based and proportionate approach to governance frameworks, AI systems, data handling, documentation and human oversight.
The FCA states that it does not plan to introduce extra regulations for AI and relies on existing frameworks, including the Consumer Duty and the Senior Managers and Certification Regime. Its Mills Review of AI in retail financial services launched on January 23, 2026, covers insurance pricing, underwriting, claims handling and fraud, and has a final report dated July 6, 2026. The approach page was first published on September 8, 2025 and last updated on October 2, 2026.
MAS issued the consultation paper on November 13, 2025 and it closed on January 31, 2026. It applies to all financial institutions including insurers and expects board and senior management oversight, AI inventories and risk materiality assessments, and lifecycle controls for data, fairness, explainability, human oversight, AI risk, testing and monitoring. MAS proposes a 12-month transition after the final guidelines issue, and a June 2026 report described MAS as still processing feedback.
OSFI published the updated Guideline E-23 on September 11, 2025, effective May 1, 2027. It applies to all federally regulated financial institutions including life and property and casualty insurers, and expressly covers AI and machine learning models. It requires enterprise-wide governance, a model inventory with risk ratings, lifecycle management from design to decommissioning, data governance, and assessment of vendor and external models under the Third-Party Risk Management Guideline.
The convergence that matters. Across the verified instruments (NAIC, Colorado, New York, EIOPA, MAS, OSFI), insurers are held accountable for AI governance with board or senior management ownership, and that accountability does not transfer to a vendor. The same instruments expect third-party vendor oversight (due diligence, audit rights, validation of vendor models) and written documentation of development, testing and monitoring. Testing for bias or unfair discrimination is explicit in the NAIC bulletin, Colorado, New York and the MAS proposal, and risk-based proportionality recurs in EIOPA, MAS and OSFI.
We did not confirm an insurer-specific AI instrument for Hong Kong, the UK prudential regulator, or Australia, and the Australian position has not yet been fully assessed.
Sources: each card links to the issuing authority where we could read its text. Cards labeled secondary rest on reputable secondary reporting and should be confirmed against the authority’s own text. Compiled by AxiLayer AI from public sources in early October 2026.
Start with an Insurance-AI Readiness Assessment built around NAIC adoption states and EU AI Act high-risk categories.
Retail AI vendors now face overlapping obligations under GDPR and ePrivacy, the EU Digital Services Act (DSA), the EU AI Act, CCPA/CPRA and the broader U.S. state privacy patchwork, FTC AI guidance (including Section 5 deceptive-practices enforcement), and global consumer-protection regulators clamping down on dark patterns, fake reviews, and manipulative personalization.
Retailers, under pressure themselves, are pushing assessment requirements down to their martech, personalization, and pricing-AI vendors.
Mapping against EU AI Act, DSA, GDPR, CCPA/CPRA, FTC AI guidance, and emerging state GenAI disclosure laws.
Review of personalization and generative UX patterns against prohibitions in the EU AI Act Article 5, DSA, and FTC enforcement trends.
Evaluation of in-store vision AI, age-estimation, and emotion-inference against BIPA, Texas CUBI, and EU AI Act biometric rules.
A documentation set aligned with retail-chain DPO, trust-and-safety, and procurement-legal reviews.
We track FTC, CMA, ACCC, state AG, DPA, and DSA coordinator activity so your conformity position reflects the latest enforcement posture.
The instruments below are the ones retailers, consumer protection authorities, and privacy regulators are reading in 2026. Statuses are shown as published; several are drafts or pending.
On August 19, 2026, the Commission voted 2-0 to publish a proposed enforcement policy statement on the use of personal data to set individualized prices, with comments due September 18, 2026. The statement warns that implying a single listed price when prices vary by individual may mislead consumers. It also warns that undisclosed collection or use of personal data for pricing could violate the FTC Act's prohibition on unfair or deceptive practices. The comment period has closed and a final statement has not been confirmed.
On September 23, 2025, the California Privacy Protection Agency announced it had finalized regulations covering automated decisionmaking technology (ADMT), risk assessments, cybersecurity audits, insurance companies and updates to the existing CCPA rules. The regulations took effect January 1, 2026, and the ADMT compliance deadline is January 1, 2027.
The Act took effect November 10, 2025. It requires a business that sets prices with an algorithm using a consumer's personal data to display the statement "THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA" with the price. On January 8, 2026, the New York Attorney General wrote to Instacart requesting pricing agreements, descriptions of pricing platforms, price experiment details and compliance screenshots, with responses due January 29, 2026. A federal court in the Southern District of New York dismissed the National Retail Federation's First Amendment challenge on October 8, 2025.
Public Act 103-0769 took effect August 2, 2024, and amended the Illinois Biometric Information Privacy Act in two ways. It limits recovery to a single violation per person when the same biometric information is collected or disclosed repeatedly by the same method to the same recipient. It also expands the definition of written release to include an electronic signature. Retailers using face-based visual search, virtual try-on or in-store recognition for Illinois shoppers remain subject to the Act's consent regime.
Regulation (EU) 2026/1744 of 8 July 2026 amends the AI Act and entered into force on 27 July 2026. Under Article 50, providers must make clear when a person is interacting with an AI system and mark synthetic audio, image, video and text in machine-readable form, and deployers must disclose emotion recognition, biometric categorization and deepfakes. Generative systems already on the market before 2 August 2026 have until 2 December 2026 to meet the marking requirement.
As of the European Parliament's Legislative Train page dated June 20, 2026, the Digital Fairness Act is an announced initiative with Commission adoption expected in Q4 2026. The Commission's public consultation closed October 24, 2025. The initiative targets dark patterns, addictive design, personalized marketing that exploits vulnerabilities (particularly of minors), influencer marketing, subscription cancellation and unfair contract terms. No legislative text has been confirmed.
The CMA's direct consumer enforcement regime under the Digital Markets, Competition and Consumers Act 2024 came into force in April 2025. On April 15, 2026, the CMA ordered the AA and BSM driving schools to refund more than 80,000 learner drivers (over 760,000 pounds) and imposed a 4.2 million pound fine, reduced from 7 million pounds for early settlement, over a booking fee not shown upfront at online checkout. It was the first use of the new powers to secure refunds, and it signals CMA priority on drip pricing and unlawful online pricing practices.
The Competition Bureau published this report on January 22, 2026, summarizing 103 responses (77 individuals and 26 organizations) received between June and August 2025. Respondents raised concerns about personalized pricing based on personal data, opaque algorithms, harm to vulnerable consumers and difficulty comparing prices. The Bureau said it will continue monitoring developments and did not announce specific regulatory or enforcement steps.
The Privacy and Other Legislation Amendment Act 2024 requires organizations that use personal information in automated decision-making that could affect individuals' rights or interests to state in their privacy policies the kinds of personal information used and the kinds of decisions made. The obligation commences December 10, 2026. The OAIC ran a consultation on guidance from May 18 to June 15, 2026.
The convergence that matters. Across the verified instruments, disclosure is the most consistent requirement: New York mandates a stated algorithmic pricing notice, the FTC proposes that undisclosed use of personal data in pricing may be deceptive, the EU requires AI interaction and content marking disclosures, and Australia requires privacy policy disclosure of automated decisions. Personal data used to set or personalize prices is the second recurring theme, appearing in the New York, FTC, Canada and California materials. Manipulation limits are supported only as a pending EU proposal (dark patterns and vulnerability targeting), and opt-out and bias requirements are not confirmed across these instruments.
Canada has no binding retail AI pricing rule that we could confirm beyond the Competition Bureau report, and Brazil’s AI bill is still moving through the legislature, so no Brazil card is included until its status is confirmed.
Sources: each card links to the issuing authority where we could read its text. Cards labeled secondary rest on reputable secondary reporting and should be confirmed against the authority’s own text. Compiled by AxiLayer AI from public sources in early October 2026.
Start with a Consumer-AI Readiness Assessment designed around the DPA, FTC, DSA, and AI-Act risk vectors that retailers now actively diligence.
The EU AI Act designates educational-access, admission-scoring, and summative-assessment AI as high-risk. FERPA, COPPA, SOPIPA, state student-privacy laws (New York Ed Law 2-d, Illinois SOPPA), UNESCO AI in Education Guidance, and the UK DfE Generative AI policy layer additional expectations.
Districts and higher-education institutions are increasingly requiring attestations before an AI vendor is approved in the LMS, SIS, or curriculum stack.
Gap analysis against EU AI Act, FERPA/COPPA/SOPIPA, New York Ed Law 2-d, Illinois SOPPA, UNESCO guidance, and UK DfE policy.
Structured review of age-gating, content-filtering, human-in-the-loop, and pedagogical grounding, aligned with leading school-district AI frameworks.
Review against Student Data Privacy Consortium (SDPC) NDPA, state DPA riders, and international student-data rules.
A documentation set aligned with CoSN, COSN Trusted Learning Environment, and EDUCAUSE AI-vendor diligence templates.
Tracking of federal, state, and international education-AI policy so your assessment record remains aligned with the annual curriculum and procurement cycle.
The instruments below are the ones school systems, education ministries, and regulators are reading in 2026. Statuses are shown as published; several are drafts or pending.
The Department published the final priority in the Federal Register on April 13, 2026, effective May 13, 2026, for discretionary grant programs. It directs applicants toward AI literacy in K-12 and higher education, educator professional development, AI used to personalize learning, universal design for learning, and evidence building, consistent with federal education, disability and civil rights law. The July 22, 2025 Dear Colleague Letter had already clarified that federal grant funds may support AI-based high-quality instructional materials, AI-enhanced high-impact tutoring, and AI for college and career pathway advising, with attention to privacy and parent engagement.
The final rule was published April 22, 2025 (90 FR 16918), took effect June 23, 2025, and most compliance was required by April 22, 2026. It adds biometric and government-issued identifiers to the definition of personal information and strengthens security, deletion and retention requirements. The FTC deferred ed-tech and school-specific amendments, citing forthcoming Department of Education FERPA revisions.
Signed by the Governor on March 19, 2026 and effective July 1, 2026. The State Department of Education must build a statewide framework, and each district and charter school must adopt a policy on student and staff use of generative AI with safeguards for privacy, data security, accessibility and academic integrity, and compliance with FERPA, CIPA and COPPA. Vendors must disclose whether products use machine learning or generative AI and give assurances on data protection, algorithmic transparency and responsible use, and the bill states that human judgment remains the final authority.
House Bill 96 requires every Ohio traditional public school district, community school and STEM school to adopt a formal artificial intelligence policy by July 1, 2026. The Department released its model policy on December 30, 2025, covering student and staff use, academic integrity, data privacy and security, curriculum integration, and a framework for evaluating third-party AI vendors and tools.
Adopted July 8, 2026 and in force July 27, 2026, the Regulation amends Regulation (EU) 2024/1689 and sets December 2, 2027 as the application date for Chapter III Sections 1 to 3 for Annex III high-risk systems, with Annex I systems moving to August 2, 2028. Annex III point 3 covers education uses such as admission, evaluation of learning outcomes, level placement and test monitoring. Separately, Article 5(1)(f) has prohibited inferring emotions of people in education institutions since February 2, 2025, except for medical or safety reasons.
First published January 22, 2025 and last updated January 19, 2026, the standards set out capabilities and features generative AI products should meet to be considered safe in educational settings. They address EdTech developers and suppliers as well as schools and colleges choosing tools. The January 2026 update added expectations on cognitive development, emotional and social development, mental health, and manipulation.
Released December 2023, the Framework was agreed by all Education Ministers and is built on four principles, including privacy, security and student safety and transparency, fairness and accountability. It states that tools must comply with Australian law, avoid unnecessary collection, limit retention, and prohibit the sale of student data, and it is reviewed at least every 12 months. The April 2026 Australian Government response to the Study Buddy or Influencer inquiry states a Children's Online Privacy Code will be in place by December 2026 and notes an Education Services Australia Responsible AI standard for assessing education technology.
Published in Gazzetta Ufficiale n. 223 on September 25, 2025 and in force October 10, 2025. Article 4, paragraph 4 requires the consent of the person exercising parental responsibility for access to AI technologies by minors under fourteen and for the resulting processing of personal data. Article 24 sets delegation criteria that include AI literacy training in universities, higher arts and music institutions and ITS Academies.
On August 4, 2025 the National Assembly passed an amendment that removes AI-powered digital textbooks from official textbook status and reclassifies them as optional education materials. It takes effect on promulgation and, per the Korea Times, remains effective until December 31, 2027. The Korea Herald reports schools lose the legal and financial basis for government-funded subscriptions.
The convergence that matters. Student data protection recurs across the FTC COPPA Rule, Idaho SB 1227, Ohio's model policy, the Australian Framework and Italy's parental consent rule for minors under fourteen. Human oversight and transparency also recur: Idaho keeps human judgment as final authority and requires vendor AI disclosure, the EU high-risk regime applies to education decisions, and the UK standards address manipulation and cognitive and emotional development. Districts are also moving vendor scrutiny into procurement, through Ohio's vendor evaluation framework, Idaho's vendor assurances and Australia's Responsible AI standard.
In Canada we found only provincial guidance and no binding instrument aimed at edtech AI vendors.
Sources: each card links to the issuing authority where we could read its text. Cards labeled secondary rest on reputable secondary reporting and should be confirmed against the authority’s own text. Compiled by AxiLayer AI from public sources in early October 2026.
Start with an Education-AI Readiness Assessment structured around district, higher-ed, and EU AI Act education obligations.
What you see here is where we start
Don't see your AI on this page? It is still in scope. Tell us what you run, and we will show you.
