compliance
Compliance means that an organization can demonstrably adhere to applicable laws, standards, and its own internal rules, including in the use of AI.
In plain terms
Compliance is like a vehicle technical inspection. It is not enough that you think the brakes are good; they must be checked according to a prescribed list, and you need a certificate for it. The same happens with companies, except the list consists of laws, standards, and internal regulations.
In AI, compliance examines whether a system's use is lawful. It must be known what data it processes, who is responsible for its decisions, whether affected parties are informed, and whether its actions are traceable. In the case of an autonomous AI agent, this is particularly important because the agent can send emails, modify data, or start processes without human approval.
Compliance does not say whether something is a good idea or moral. It says whether it meets the described rules. Therefore, compliance is the minimum, not the goal: a compliant system can still be bad, unjust, or useless.
How it works
- Survey: the organization inventories which AI systems and agents it uses, for what purposes, and with what data.
- Identifying rules: determining which regulations apply to them, such as the EU AI Act, GDPR, sector-specific rules, and the company's own policies.
- Risk classification and measures: riskier uses come with stricter requirements, such as human oversight, testing, access limits, and notification.
- Documentation and logging: they describe who is responsible for what and record what the system did, so compliant operation can be proven afterward.
- Verification and correction: internal or external audits regularly check whether rules are followed, and errors are fixed because both systems and regulations change.
An everyday example
Your workplace issues a policy stating that you cannot paste customer data into public chatbots and may only use company-approved AI tools. This is compliance in practice: the company thus tries to ensure that AI use does not violate data protection or confidentiality rules.
Who is affected
A common misconception
Limits and risks
- Regulations change slower than technology, so there is often no clear rule for a new AI capability yet.
- Compliance can easily turn into paper-pushing: a ticked checklist does not replace real testing and attention.
- With autonomous agents, it is difficult to regulate every step in advance, so without logging and human supervision, compliance is barely provable afterwards.
- Requirements differ by country and sector, so what is compliant in one place may not be in another.
Similar, but not the same
- AI ethics – Ethics asks what is right, while compliance asks what the rules prescribe, and the two do not always align.
- AI governance – Governance is the entire decision-making and responsibility system within an organization, while compliance is the part that ensures and verifies adherence to rules.
- audit – An audit is an independent examination covering a specific period, conducted once or regularly. Compliance, however, is a continuous state and activity that the audit examines.
Related concepts
AI governance, regulation, risk management
conformity assessment, data protection compliance
EU MI-rendelet, GDPR, audit, logging, human oversight, transparency, accountability
A brief history
Compliance grew out of financial and corporate regulation, and the GDPR, applicable from 2018, made it widely known in Europe regarding data processing. The EU's AI Act, adopted in 2024, extended it comprehensively to AI.
Where things stand
The obligations of the EU AI Act become applicable in stages. Rules on prohibited practices have applied since February 2025, and those on general-purpose AI models since August 2025. The original August 2026 deadline for requirements on high-risk systems was postponed by the EU through the digital omnibus package, likely to the end of 2027 or to 2028. As a result, at the end of 2026 many organizations are still building their AI compliance processes. Practice around agents is particularly immature.
In the news
- Five things German firms believe about the AI Act, and what the text saysNov 2, 2026 · Jog
- Vertex launches Vertex Sōl, an AI-powered tax and compliance platformOct 26, 2026 · Money
- EN 18286 becomes the first harmonised standard under the EU AI ActOct 26, 2026 · Jog
- China's AI regulation in 2026: enforcement, guidance and complianceOct 26, 2026 · Jog
- First harmonised standard supporting the AI Act published in the Official JournalOct 19, 2026 · Jog
- AI-generated evidence in drug discovery: reliability, legal risk and FDA complianceOct 19, 2026 · Health
- Legal tech funding: Pandektes raises €13.5m, a Danish start-up €2m, Leela $4.6mOct 12, 2026 · Jog
- Three administrative AI startups raise funding in healthcareOct 12, 2026 · Health
Also known as
compliance · compliance · compliance · regulatory compliance · regulatory compliance · regulatory compliance · AI compliance · AI compliance
Sources
This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.