AI Compliance Checklist 2026: EU AI Act, NIST, and ISO 42001 Explained

August 2026 is not far off. That’s when the EU AI Act becomes fully enforceable and for organizations that haven’t started preparing, it’s going to arrive faster than expected.

But the EU AI Act isn’t the only regulation you’re managing. Depending on where your business operates, who your customers are, and what your AI actually does, you could also be working against NIST AI RMF requirements, ISO 42001 certification demands, and a growing stack of US state-level AI laws. Each one has different requirements, different deadlines, and different consequences for falling short.

This article gives you a working checklist for each framework not summaries, not explanations of what the regulations say, but specific action items you can tick off. The goal is to leave here knowing exactly what you need to do, not just what the rules are.

The August 2026 EU AI Act Deadline

The EU AI Act becomes fully applicable in August 2026. Organizations using high-risk AI systems — including those in hiring, credit scoring, biometric identification, critical infrastructure, and medical devices — must demonstrate compliance through documentation, testing, and registration or face penalties of up to €30 million or 6% of global annual revenue. Prohibited AI practices have already been banned since February 2025.

Understanding the 3 AI Compliance Frameworks You Need to Know in 2026

Before getting into the checklists, it helps to know which frameworks actually apply to your organization. Using the wrong checklist for the wrong regulation wastes time. Using no checklist costs more.

EU AI Act

Mandatory for any organization using or deploying AI in the European Union — including non-EU companies whose AI systems affect EU residents. It’s a risk-tiered framework: unacceptable-risk AI is banned outright, high-risk AI must meet strict documentation and oversight requirements, and lower-risk AI has lighter transparency obligations. Enforcement begins August 2026 for most requirements, though prohibited practices have been off the table since February 2025.

Who must comply: any business whose AI touches EU customers, employees, or residents — regardless of company size or headquarters.

NIST AI RMF (AI Risk Management Framework)

Voluntary in the US, but increasingly required for government contracts, enterprise procurement relationships, and regulated industries. The framework is organized around four functions: Govern, Map, Measure, and Manage. It’s more flexible than the EU AI Act — there’s no certification requirement — but its structure is solid for building an internal AI risk process. Several US federal agencies now expect NIST alignment as a condition of doing business.

Who should use it: US-based organizations, anyone selling to US government or large enterprise clients, and any organization that wants a structured approach without mandatory certification.

ISO 42001

The first international standard specifically for AI management systems, published in 2023. It’s certifiable — you can get third-party validation — which makes it increasingly relevant for enterprise procurement and global operations. More and more RFPs, especially from large European and multinational companies, are starting to ask whether suppliers have ISO 42001 alignment or certification.

Who needs it: organizations that want third-party validation of their AI governance, those operating across multiple regulatory jurisdictions, and businesses whose clients are starting to ask for certification evidence.

For a full comparison of which framework fits which organization size and type, the AI governance framework guide covers the decision matrix in detail.

EU AI Act Compliance Checklist: 15 Action Items for High-Risk AI Systems

The EU AI Act requires action, not just awareness. These 15 items cover the core obligations for organizations using or deploying high-risk AI. High-risk categories include AI used in hiring, education, credit scoring, law enforcement, biometric identification, critical infrastructure, and medical devices.

Work through this list from the top. The first item determines whether the rest apply to you.

☐ 1. Identify whether your AI systems fall under high-risk categories (Annex III) Check each AI system you use or deploy against the categories listed in Annex III of the EU AI Act. If any system affects decisions in hiring, credit, education, public safety, or medical contexts and operates in the EU, it very likely qualifies as high-risk. This is the classification step everything else depends on.

☐ 2. Register high-risk AI systems in the EU database before August 2026 The European Commission is establishing an EU-wide database for high-risk AI systems. Registration will be mandatory before deployment. Non-EU providers must register through an authorized EU representative.

☐ 3. Conduct a conformity assessment for each high-risk system Conformity assessment means documenting that your system meets the Act’s technical requirements. For most high-risk AI, this is a self-assessment. For certain biometric and law enforcement applications, third-party assessment is required.

☐ 4. Create and maintain technical documentation for each AI system Technical documentation must cover: the system’s intended purpose, design specifications, training data characteristics, performance metrics, known limitations, and the human oversight mechanisms in place. This documentation must be kept up to date and available for regulatory inspection.

☐ 5. Implement a Quality Management System (QMS) for AI The EU AI Act requires providers of high-risk AI to have a documented QMS covering the full lifecycle — from design through deployment and monitoring. For organizations already ISO 9001 certified, this is an extension of existing quality processes. For others, it’s a new system to build.

☐ 6. Establish human oversight mechanisms for automated decisions High-risk AI systems must be designed to allow human intervention. This means building override capabilities, defining who has override authority, and documenting what constitutes a trigger for human review. “The AI decided” is not an acceptable answer under the EU AI Act.

☐ 7. Test for accuracy, robustness, and cybersecurity Testing must be documented and must cover performance across diverse user groups, including testing for discriminatory outputs. Robustness testing covers whether the system behaves consistently under varied inputs. Cybersecurity testing covers protection against adversarial attacks.

☐ 8. Create a risk management system and document it A risk management system under the EU AI Act is an ongoing process, not a one-time assessment. It must identify risks, evaluate them, implement mitigation measures, and document residual risks. The system must run throughout the AI lifecycle.

☐ 9. Use appropriate training, validation, and testing data sets Training data must be representative, accurate, and relevant to the intended application. Data governance practices must be documented, including how biases were identified and addressed. This is one of the areas where why AI projects fail without governance becomes a compliance issue — data fragmentation and poor data governance create both performance failures and regulatory exposure.

☐ 10. Keep logs and audit trails for at least 6 months High-risk AI systems must automatically generate logs of their operation. These logs must be retained for at least six months after use. For systems used in law enforcement or judicial contexts, longer retention applies.

☐ 11. Provide users with clear information about AI system capabilities and limits Users interacting with high-risk AI must know they’re using AI, what the system can and cannot do, and how to interpret its outputs. This is particularly relevant for AI used in healthcare, hiring, and financial decisions — sectors where users may assume the AI’s judgment is authoritative when it isn’t.

☐ 12. Establish a post-market monitoring system After deployment, high-risk AI systems must be continuously monitored for performance drift, unexpected outputs, and emerging risks. Monitoring findings must feed back into the risk management system. This is not optional or informal — it needs to be a documented, systematic process.

☐ 13. Report serious incidents to the relevant national authority If a high-risk AI system causes a serious incident — harm to health, safety, or fundamental rights — the incident must be reported to the relevant national supervisory authority. The EU AI Act doesn’t specify an exact reporting timeline for all incident types, but immediate action and documentation are expected.

☐ 14. Appoint an EU authorized representative (for non-EU companies) If your company is based outside the EU but your AI systems operate in EU markets or affect EU residents, you must appoint an authorized representative established in the EU. This representative takes on regulatory responsibilities on your behalf.

☐ 15. Ensure GPAI model providers disclose training data summaries General-purpose AI model providers — companies offering foundation models like large language models — must publish summaries of the training data used, respect copyright obligations, and for high-capability models, conduct adversarial testing. If your organization uses third-party foundation models, verify that the provider is compliant.

NIST AI RMF Compliance Checklist: 12 Action Items

The NIST AI Risk Management Framework doesn’t require certification and there’s no enforcement body. What it does is give you a structured process that satisfies the growing expectation from US government clients, large enterprise procurement teams, and regulated industries that your AI risk management is systematic and documented.

These 12 items follow the framework’s four functions: Govern, Map, Measure, Manage.

☐ 1. Map your AI systems to NIST’s 4 core functions: Govern, Map, Measure, Manage Start by understanding which of your AI systems need formal risk management and which function in the NIST framework applies to each stage of those systems’ lifecycles. This mapping exercise is the foundation for everything else.

☐ 2. Establish an AI governance policy at the organizational level The GOVERN function requires that AI risk management is embedded in organizational policy — not just practiced informally. Document who owns AI risk management, what the accountability structure is, and how AI governance decisions get made. For small businesses, the AI governance for small business guide covers how to set this up without enterprise overhead.

☐ 3. Define roles and responsibilities for AI risk management Every AI system needs an assigned owner — a person or team responsible for risk identification, monitoring, and escalation. This is the RACI work that NIST’s GOVERN function requires. Ambiguity here is where governance fails in practice.

☐ 4. Categorize AI systems by risk level using NIST AI RMF categories NIST doesn’t mandate a specific categorization scheme, but it does require that you assess the probability and severity of potential harms for each AI system and assign a risk level. Higher-risk systems need more rigorous controls. Lower-risk systems need lighter but still documented oversight.

☐ 5. Conduct AI risk assessments for each system The MAP function requires identifying the specific risks associated with each AI system — including how the system might fail, who it could harm, and in what contexts those harms are most likely. Risk assessments need to be documented and reviewed regularly, not done once at deployment.

☐ 6. Document AI system purpose, context, and expected users Before an AI system is deployed, document what it is supposed to do, the environment in which it operates, who its users are, and what constraints apply to its use. This is context documentation, and it’s foundational to every other NIST assessment that follows.

☐ 7. Identify and evaluate potential AI impacts and harms This goes beyond technical failure scenarios. NIST’s MAP function requires considering impacts on individuals, groups, organizations, and broader society. For AI used in hiring, credit, or healthcare — sectors with higher stakes — this evaluation needs to include disparate impact analysis.

☐ 8. Implement technical and organizational controls Based on the risk assessment, implement the controls that reduce identified risks to acceptable levels. Technical controls include monitoring systems, access restrictions, and testing protocols. Organizational controls include training, approval workflows, and incident response procedures.

☐ 9. Monitor AI systems for performance drift and unexpected outputs The MANAGE function requires ongoing monitoring. Set baselines for expected performance, define thresholds that trigger review, and implement the monitoring infrastructure to catch when outputs deviate from those baselines. This is the same monitoring requirement that appears in the EU AI Act — it’s consistent across frameworks because it’s genuinely important.

☐ 10. Create incident response procedures for AI failures When an AI system produces a harmful or significantly erroneous output, your team needs a documented procedure for what happens next. Who is notified? How is the incident documented? What constitutes a rollback trigger? Without this documented, response under pressure is improvised and usually inadequate.

☐ 11. Communicate AI risks to stakeholders transparently NIST expects that AI risks — including residual risks that can’t be fully mitigated — are communicated to relevant stakeholders. For customer-facing AI, this includes the people whose decisions are being affected. For internal AI, it includes the teams using the outputs. Transparency here is a governance requirement, not just a values statement.

☐ 12. Review and update AI risk management annually NIST AI RMF is not a set-it-and-forget-it exercise. AI systems change, deployment contexts change, and the regulatory environment changes. Annual review — with documented findings and updates — is the minimum cadence for keeping the MANAGE function credible.

ISO 42001 Compliance Checklist: 13 Requirements for Certification

ISO 42001 is the most structured of the three frameworks. It follows the same high-level structure as other ISO management system standards (like ISO 9001 for quality, ISO 27001 for information security), which means organizations already familiar with those standards have a significant head start.

Certification requires a third-party audit from an accredited certification body. These 13 items are what you need to have in place before that audit.

☐ 1. Establish an AI Management System (AIMS) aligned with ISO 42001 structure The AIMS is the core deliverable — a documented system covering the scope of your AI activities, the organizational context, leadership commitment, planning, support, operations, performance evaluation, and improvement. It follows the ISO Annex SL structure used by most modern ISO standards.

☐ 2. Define organizational context and AI objectives ISO 42001 requires that you formally document your organization’s internal and external context as it relates to AI — what AI you use, why you use it, who it affects, and what your AI-related objectives are. This is Clause 4 of the standard and is foundational to everything that follows.

☐ 3. Gain leadership commitment and assign AI management roles Clause 5 requires visible leadership commitment. This means senior leadership must formally endorse the AIMS, assign responsibility for its operation, and ensure it has adequate resources. This is not just a sign-off — auditors look for evidence that leadership is actively engaged.

☐ 4. Conduct AI risk and impact assessment ISO 42001 requires a structured assessment of AI-related risks and impacts — both to the organization and to affected individuals and groups. This assessment must be documented, reviewed, and updated when the AI landscape changes.

☐ 5. Create AI policy and make it available to stakeholders An organizational AI policy — separate from individual AI system documentation — must be established, documented, and communicated. It should state the organization’s commitment to responsible AI, its objectives, and the principles that govern its AI activities.

☐ 6. Define AI system lifecycle processes Clause 8 covers the operational requirements. This includes documenting how AI systems are designed, developed, deployed, monitored, updated, and decommissioned. Every stage of the lifecycle needs a defined process, not just deployment.

☐ 7. Establish AI supply chain requirements for third-party AI If your organization uses third-party AI systems, models, or components, ISO 42001 requires that you have documented requirements for those suppliers — including what governance and safety standards they must meet. “We trust the vendor” is not sufficient.

☐ 8. Implement data management procedures ISO 42001 requires documented procedures for how data is acquired, stored, processed, and used in AI systems. This covers training data, operational data, and any data generated by AI outputs. Data quality, lineage, and access controls all fall under this requirement.

☐ 9. Create competency requirements for AI staff Anyone involved in AI development, deployment, or oversight must meet defined competency requirements. These requirements must be documented, and the organization must have a process for ensuring staff are trained to meet them.

☐ 10. Document AI system characteristics and intended use Every AI system covered by the AIMS must have documentation of its characteristics — what it does, how it works at a functional level, what its known limitations are, and what it is and is not intended to be used for.

☐ 11. Monitor and measure AI system performance Clause 9 covers performance evaluation. AI systems must be monitored against defined performance indicators, and the monitoring results must be analyzed and used to drive improvements. This is similar to the monitoring requirements in the EU AI Act and NIST, but ISO 42001 requires it to be explicitly tied to the AIMS improvement cycle.

☐ 12. Conduct internal audits of the AIMS ISO 42001 requires regular internal audits of the entire management system — not just individual AI systems. These audits must be planned, conducted by competent auditors, and documented. Findings must be addressed through the corrective action process.

☐ 13. Plan and undergo certification audit by an accredited body Once the AIMS is operational and internal audits confirm it meets ISO 42001 requirements, the final step is an external audit by an accredited certification body. This is a two-stage process: a documentation review (Stage 1) followed by an on-site assessment (Stage 2). Maintaining certification requires surveillance audits annually and a recertification audit every three years.

US AI Regulations: State-by-State Compliance Overview

There is no federal US AI law yet. But that doesn’t mean US organizations have no compliance obligations — state legislatures have moved quickly, and several laws are already in effect or taking effect in 2026.

The critical thing to understand about US state AI law is that it changes fast. A state that has no AI law today may have one in 12 months. Organizations operating across multiple states should be monitoring legislative developments regularly — several organizations including Future of Privacy Forum and the National Conference of State Legislatures maintain public trackers.

How to Build an AI Compliance Program: From Audit to Certification

Working through multiple checklists is useful. But checklists without a program structure produce incomplete compliance — boxes get checked, then nothing is maintained, and when an audit arrives, the documentation doesn’t hold up.

Here’s a four-phase program structure that works whether you’re targeting EU AI Act compliance, NIST alignment, ISO 42001 certification, or all three.

Phase 1: AI Inventory Audit (Weeks 1–2)

Catalog every AI system in use across the organization — not just the ones IT knows about. This includes:

• AI features built into SaaS products (CRM, HR software, customer support tools)
• AI tools used by individual teams without central approval (shadow AI)
• Custom AI models built internally
• Third-party AI accessed via API

For each system, document: what it does, what data it uses, who uses it, what decisions it affects, and whether it touches EU or California customers. This inventory is the foundation of every compliance assessment that follows.

A quick self-assessment to start:

If you answered No to more than two of these, Phase 1 is where to start — before anything else.

Phase 2: Gap Analysis (Weeks 3–4)

Map your current practices against the applicable regulations. For each requirement in the relevant checklist above, assess your current state: fully in place, partially in place, or not in place. This gap analysis tells you where to concentrate remediation effort.

The most common gaps found in practice: missing technical documentation, no post-deployment monitoring, no incident response procedure, and undefined data governance for AI training data. These are also the gaps that produce the biggest compliance risk.

Phase 3: Remediation (Months 2–3)

Address the gaps identified in Phase 2, working from highest risk to lowest. High-risk gaps — missing conformity assessments for EU AI Act high-risk systems, no incident reporting process, no human oversight mechanisms — should be prioritized regardless of effort required.

Lower-risk gaps — documentation cleanup, policy updates, training schedule formalization — can follow once the critical items are addressed.

Phase 4: Evidence Collection and Audit (Months 4–6)

Compile the documentation that demonstrates compliance: risk assessments, technical documentation, monitoring logs, incident records, training records, audit results. For ISO 42001 certification, this package goes to the external certification body. For EU AI Act, this documentation must be available on demand to national supervisory authorities. For NIST, it demonstrates alignment when clients or government partners ask.

FAQs: AI Compliance in 2026

When does the EU AI Act become enforceable? The prohibited AI practices under the EU AI Act have been banned since February 2025. The obligations for high-risk AI systems — including registration, technical documentation, conformity assessment, and post-market monitoring — become enforceable in August 2026. General-purpose AI model obligations took effect in August 2025.

What happens if my business doesn’t comply with the EU AI Act? Penalties scale with the violation. Using prohibited AI systems can attract fines of up to €35 million or 7% of global annual revenue. Non-compliance with high-risk AI obligations carries fines of up to €15 million or 3% of global revenue. Providing incorrect information to supervisory authorities carries fines of up to €7.5 million or 1% of global revenue. For SMEs, fines are capped proportionally, but the risk of reputational damage often exceeds the financial penalty.

Is NIST AI RMF mandatory in the US? No — NIST AI RMF is voluntary for private sector organizations. However, it is increasingly referenced as a baseline expectation in US federal procurement requirements, defense contracts, and regulated industries including financial services and healthcare. “Voluntary” doesn’t mean without consequence if you’re selling to government or enterprise clients who expect NIST alignment.

Do I need ISO 42001 certification? Not legally — no jurisdiction currently mandates ISO 42001 certification. But enterprise procurement is changing. Large organizations are increasingly requiring their AI suppliers to demonstrate governance standards, and ISO 42001 certification is becoming a straightforward way to do that. If your business sells AI-related products or services to enterprise clients, expect the question to come up.

What is a high-risk AI system under the EU AI Act? The EU AI Act defines high-risk AI systems in Annex III. The categories include: AI used in critical infrastructure (energy, water, transport); AI in educational or vocational training; AI in employment, recruitment, and worker management; AI affecting access to essential public and private services (credit scoring, insurance); AI in law enforcement; AI in migration and border management; AI in administration of justice; and AI in democratic processes. Biometric identification systems are also high-risk with additional restrictions.

Conclusion: Start Your Compliance Journey Today

August 2026 sounds far away until it isn’t. Organizations that start now will be working through Phase 3 remediation in the spring. Organizations that wait until the summer will be scrambling.

Three things to do this week:

1. Run the AI inventory audit. Find out what AI your organization is actually using before you try to comply with anything. The inventory is the prerequisite to every other step.

2. Identify your highest-risk systems. Check each AI system against the EU AI Act’s Annex III high-risk categories. If anything qualifies, that system needs to be your first priority.

3. Pick the right framework. Use the orientation section at the top of this article to determine whether EU AI Act, NIST, ISO 42001, or some combination applies to your situation.

For the broader organizational context — why compliance is only part of what AI governance requires — the guide on why AI projects fail covers the governance failures that compliance programs alone don’t prevent.

And for small businesses wondering whether any of this applies to them, the AI governance for small business guide explains which regulations apply at which scale and what the minimum viable compliance program looks like.