AI Governance for Small Teams: The Complete Guide (2026)

Image: Unsplash, used under the Unsplash License.

TL;DR: AI governance for small teams means knowing which AI tools are in use, what data they process, what can go wrong, and who is responsible when it does. For a small team without a dedicated compliance function, governance is five things: a written policy, a risk assessment process, vendor due diligence, ongoing monitoring, and sector-specific compliance.

At a glance: Start with a use-case inventory and an AI acceptable use policy, those two documents cover most governance obligations for small teams. Add vendor due diligence before any new AI deployment. For EU AI Act Annex III high-risk uses (hiring, credit scoring, education, essential services), the high-risk rules apply from December 2, 2027 (moved from August 2, 2026 by the Digital Omnibus on AI, Regulation (EU) 2026/1744). AI in regulated products such as medical devices follows on August 2, 2028. Shadow AI is the highest-probability risk: employees using unapproved tools with company data, invisible to the governance process.

This guide covers: What AI governance actually requires (4 obligations) • AI acceptable use policy, your first document, with template • AI risk assessment, matching controls to risk level • AI vendor due diligence, what to check before signing • EU AI Act December 2027 date, what small teams must do • Sector-specific compliance (healthcare, HR, fintech) • Roles and responsibilities on a 5-person team • Shadow AI, the hidden risk most teams don't see • Data privacy (GDPR, CCPA, training opt-out) • Developer AI tools governance • Red teaming and incident response • Monitoring and ongoing compliance • Full 29-item AI governance checklist

This guide covers every component of AI governance for small teams with links to the deep-dive guide for each area. Read it end-to-end to understand the full picture, or jump to the section most relevant to your immediate situation.

1. What AI Governance Actually Requires

AI governance is not a policy document sitting in a shared drive. It is an operational process with four ongoing activities:

1. Inventory: knowing which AI tools are in use, by whom, and with what data
2. Policy: documented rules for approved use, prohibited use, and data handling
3. Risk management: categorizing each AI tool by risk level and applying controls proportionate to that risk
4. Oversight: human review mechanisms, monitoring, and a cadence for reviewing AI decisions

For small teams, the practical version of this is: one designated AI Governance Lead (does not need to be a full-time role), a documented list of approved tools, a vendor review checklist for new tools, and a short monthly review meeting.

Once your framework is running, use the AI governance metrics dashboard to measure whether it's working, 15 indicators covering tool inventory, vendor DPA coverage, policy acknowledgment, incident response, and upcoming regulatory deadlines.

2. AI Acceptable Use Policy: Your First Document

Image: Pexels, used under the Pexels License.

The AI acceptable use policy is the foundation of everything else. It answers four questions:

• Which AI tools are approved for work use?
• What data can and cannot be put into AI tools?
• What decisions can AI assist with, and which require human judgment?
• What happens when an AI tool is misused or causes a problem?

What a policy must cover:

A starting policy does not need to be long. A one-page document that covers the above five elements is more effective than a detailed policy that no one reads.

The AI acceptable use policy template is a complete copy-paste document covering all five required elements, approved tools table, data classification rules (4 classes from Public to Restricted), prohibited uses, incident reporting procedure, and employee acknowledgment form. Customize the bracketed fields and publish to your team wiki. For evaluating whether new AI tools belong on your approved list, use the 40-prompt vendor evaluation guide to run a structured procurement review before approving any new tool.

3. AI Risk Assessment: Matching Controls to Risk

Not all AI tools carry the same compliance obligation. A writing assistant used to draft internal emails is lower risk than an AI system that screens job applicants or processes medical records. Risk assessment maps each AI deployment to the right level of controls.

The four risk levels used by the EU AI Act (NIST AI RMF does not use fixed tiers, but its Map and Measure steps fit the same process):

For each AI tool your team uses, the risk assessment asks: what decisions does this tool influence, who is affected, and what happens if it produces an incorrect or biased output?

The practical process for small teams:

1. List every AI tool in use (including embedded AI in SaaS products)
2. For each tool, identify: what data it processes, what decisions it influences, and who the affected population is
3. Score by risk level using the matrix above
4. Assign required controls based on risk level

The AI risk assessment guide includes a scoring matrix, a risk register template, and worked examples for common small-team AI deployments (AI writing tools, AI code assistants, AI customer support, AI analytics).

For teams using AI in financial decisioning (credit scoring, fraud detection, underwriting), see the AI risk decisioning governance checklist, which covers US Treasury FS AI RMF requirements, FCRA/ECOA compliance for automated decisions, and a 10-point checklist for financial service teams. For a structured self-assessment across 25 governance questions, the AI regulatory readiness scorecard produces a scored compliance maturity verdict for software and biotech teams.

4. AI Vendor Due Diligence: Before You Sign

Every AI tool you deploy is a vendor relationship. Before deploying any AI tool that touches company or customer data, a vendor review should cover:

The three critical questions:

1. Does the vendor train on your data? Many AI tools use your prompts and data to improve their models by default. For any proprietary or customer data, confirm the vendor has training opt-out enabled for your account, or use a tool that does not train on your data at all.

2. Does the vendor have a Data Processing Agreement (DPA)? Under GDPR, any third party processing personal data on your behalf must sign a DPA. For US teams handling regulated data (healthcare, financial), equivalent agreements apply. Enterprise-tier tools typically offer DPAs; consumer-tier tools typically do not.

3. What happens in a security incident? Your vendor is part of your supply chain. If their AI infrastructure is breached, your data may be exposed. Confirm their breach notification timeline and your response obligations.

For healthcare teams, a fourth critical question applies: does the vendor offer a HIPAA Business Associate Agreement (BAA)? Using any AI tool that processes protected health information (PHI) without a signed BAA is a HIPAA violation.

The AI vendor due diligence checklist provides 30 questions across security, privacy, compliance, and contractual obligations, each with pass/fail criteria.

For a comparison of which major AI API providers train on your data and which offer DPAs and BAAs, the privacy-first AI API guide covers Anthropic, OpenAI, Google, Cohere, Mistral, and others with training data policies and enterprise contract terms side-by-side.

For a side-by-side GDPR compliance comparison of the six major AI assistants (Claude, ChatGPT, Gemini, Mistral, M365 Copilot, Cohere), see the GDPR-compliant AI assistants comparison, which scores each across DPA availability, training opt-out, EU data residency, SOC 2, and GDPR Article 28 compliance. For investors and founders assessing AI governance before a funding round, the VC AI governance due diligence checklist is an 18-item checklist of what founders are being evaluated against.

5. EU AI Act: The December 2027 Compliance Deadline

The EU AI Act is the most significant AI regulation affecting small teams globally. Its Annex III high-risk rules for employment, credit, education, and essential-services AI apply from December 2, 2027, moved from August 2, 2026 by the Digital Omnibus on AI (Regulation (EU) 2026/1744, signed July 8, 2026). High-risk AI inside products covered by Annex I, such as medical devices, follows on August 2, 2028. Teams deploying AI in these categories for EU residents are in scope regardless of where the company is based.

Image: Pexels, used under the Pexels License.

What triggers high-risk classification (Annex III):

• AI used in hiring, promotion, termination, or task assignment decisions
• AI used to evaluate creditworthiness or establish credit scores (point 5(b))
• AI used for risk assessment and pricing in life and health insurance (point 5(c))
• AI used by public authorities to decide eligibility for public assistance benefits (point 5(a))
• AI used in education access and assessment
• Biometric identification systems
• Critical infrastructure AI

What high-risk classification requires:

• Conformity assessment: documentation that the system meets EU AI Act requirements before deployment
• Bias and accuracy testing: performance testing across demographic groups, documented
• Human oversight mechanism, the system is designed so that trained people can monitor it and override or stop it (Article 14)
• Individual notice, deployers of Annex III systems that make or assist decisions about people must tell those people (Article 26(11))
• EU database registration, providers register Annex III systems in the EU database (Articles 49 and 71) before placing them on the market
• Post-market monitoring: ongoing performance tracking after deployment

For US teams, Colorado SB 26-189 repeals and reenacts the 2024 Colorado AI Act (SB 24-205). The governor signed it on May 14, 2026. From January 1, 2027, deployers must give consumers clear notice at the point of interaction with automated decision-making technology used in a consequential decision, explain its role within 30 days after an adverse outcome, and keep compliance records for at least 3 years. See the Colorado SB 189 rewrite guide for what changed and what you still need to do.

Other active US state AI laws for 2026: Connecticut SB 5 (signed May 27, 2026; subscription AI disclosures and frontier-developer whistleblower rules from October 1, 2026, automated employment decision technology requirements operative October 1, 2027, see Connecticut AI law checklist); Washington SSB 5886 (adds a "forged digital likeness" to the state personality rights law; signed March 16, 2026, effective June 11, 2026 per the legislature's bill page, see Washington AI likeness compliance); Maryland HB 895 (Chapter 154; bars food retailers and third-party delivery services from dynamic pricing or using consumer personal data to set prices, effective October 1, 2026, see Maryland AI pricing law).

For a comparison of EU AI Act vs. NIST AI RMF requirements and how to satisfy both with a single documentation set, see the EU AI Act vs NIST AI RMF guide. For the complete EU AI Act compliance guide covering all risk tiers, prohibited AI, GPAI obligations, sector-specific requirements, and the full compliance checklist, see the EU AI Act compliance complete guide.

6. Sector-Specific Compliance

Three sectors have AI-specific compliance requirements that go beyond general governance obligations. If your team operates in healthcare, HR/hiring, or financial services, these apply on top of the baseline framework.

Image: Pexels, used under the Pexels License.

Healthcare: HIPAA + FDA SaMD + EU AI Act

Healthcare AI must satisfy three separate regulatory frameworks simultaneously:

• HIPAA applies whenever an AI tool processes Protected Health Information (PHI). Every AI vendor that touches PHI must sign a HIPAA BAA before receiving any patient data. BAAs are plan-specific: OpenAI offers them for its API and for sales-managed ChatGPT Enterprise or Edu accounts and says it does not offer one for ChatGPT Business; Anthropic's BAA covers commercial products such as Claude for Work and the API. If your plan is not covered by a signed BAA, keep PHI out of it.

• FDA Software as a Medical Device (SaMD) rules apply when AI influences clinical decisions. Section 3060(a) of the 21st Century Cures Act (enacted December 13, 2016) excludes certain clinical decision support software from the device definition, mainly where the clinician can independently review the basis for the recommendation. AI outside that exclusion is a medical device and needs a premarket pathway such as 510(k) clearance, De Novo classification, or premarket approval.

• EU AI Act high-risk classification applies when the AI is itself a medical device, or a safety component of one, that needs a third-party conformity assessment under the MDR or IVDR (Article 6(1) and Annex I); those rules apply from August 2, 2028. Emergency healthcare patient triage systems are listed separately in Annex III, point 5(d).

The healthcare AI governance guide covers all three frameworks, the BAA checklist for AI vendors, the FDA SaMD risk classification matrix, and the practical implementation checklist for small clinical practices and health tech startups.

HR: EU AI Act High-Risk + EEOC Disparate Impact

AI hiring tools are explicitly classified as high-risk under the EU AI Act (Annex III, point 4). This is not a judgment call, it is a statutory classification. The compliance obligations apply to employers (deployers), not just to the AI vendors who build the tools.

Under Title VII and the ADA, employers are liable for discriminatory outcomes from AI hiring tools regardless of vendor claims. (The EEOC's 2023 Technical Assistance on AI was withdrawn January 2025, but the underlying legal obligations under Title VII, the ADA, and the Age Discrimination in Employment Act remain in force.) The standard screen is the four-fifths rule in the federal Uniform Guidelines (29 CFR 1607.4(D)): a selection rate for a race, sex, or ethnic group below four-fifths (80%) of the highest group's rate is generally regarded as evidence of adverse impact, which the employer then has to be ready to justify.

Several US states have additional requirements: NYC Local Law 144 bars using an automated employment decision tool unless it had a bias audit within one year of use, with the results public and notices given to candidates, Illinois requires disclosure before AI video interview analysis, Connecticut SB 5 adds pre-decision notices for AEDT (automated employment-related decision technology), operative October 1, 2027, and Colorado SB 26-189 (signed May 14, 2026, effective January 1, 2027) requires notice when automated decision-making technology is used in consequential decisions, including employment. See the AI hiring tool compliance matrix for the full state-by-state breakdown.

The HR AI governance guide covers conformity assessment requirements for hiring AI, the EEOC 4/5ths testing methodology, candidate disclosure language templates, and the five vendor due diligence questions to ask before deploying any AI hiring tool.

Fintech: CFPB + FCRA + EU AI Act Credit Scoring

AI used in credit decisions triggers three compliance frameworks at once. The adverse action requirement under ECOA (Regulation B, 12 CFR 1002.9) is the most immediate compliance gap: when AI denies or limits a credit application, the notice must include a statement of specific reasons for the action. "Our model decided" is not a reason. The CFPB's 2023 circular on AI and adverse action (Circular 2023-03) is now marked as archived on its site, but the Regulation B text has not changed.

The FCRA applies when your AI model uses data from a consumer reporting agency. EU AI Act Annex III point 5(b) explicitly lists AI credit scoring as high-risk, with an exception for fraud detection.

The fintech AI governance guide covers ECOA-compliant adverse action reason codes, disparate impact testing for credit AI, the combined ECOA + FCRA adverse action notice template, and EU AI Act conformity requirements for AI credit scoring systems.

7. Roles and Responsibilities

For a small team, AI governance does not require a dedicated compliance officer. It requires defined ownership:

In most small teams, the AI Governance Lead is the CTO, Head of Engineering, or a senior operations manager who already has compliance adjacent responsibilities. What matters is that the role is explicitly named, governance without a named owner defaults to no governance.

The AI governance roles and responsibilities guide provides the role definitions and time estimates. For a copy-paste version ready for a spreadsheet, use the AI governance RACI template, it covers 12 activities from tool approval to EU AI Act documentation.

8. Shadow AI: The Hidden Risk

Shadow AI is the use of AI tools outside the governance process: employees using personal accounts on consumer AI products with company or customer data, AI features embedded in SaaS products that activate without announcement, and AI integrations built by individual team members without security review.

Why shadow AI is the highest-probability compliance risk:

• It is invisible to the governance process by definition
• Consumer AI tools rarely offer DPAs, training opt-outs, or BAAs
• A single employee pasting customer data into an unapproved AI tool creates a potential GDPR or HIPAA violation
• Shadow AI grows when approved tools are too slow, restricted, or inaccessible, governance that creates friction accelerates it

How to detect and reduce shadow AI:

1. Audit network traffic: DNS queries to known AI APIs that are not in your approved list
2. Browser extension audit: many AI writing assistants are installed as browser extensions without IT visibility
3. SaaS AI feature audit: review settings in every SaaS product for AI features (Notion AI, Slack AI, HubSpot AI, etc.) that may have been enabled by default
4. Reduce the friction on approved tools: if the approved AI tool is harder to use than the shadow alternative, shadow AI will win

IT providers who run small-business networks say the same thing. In a July 2026 r/msp thread titled "Company data leaking into AI tools", one commenter wrote: "Policy and training will always be ignored if a staff member thinks it will save them time when it comes to using AI." Another replied that the realistic goal is to "make it as difficult as possible to do the wrong thing, while making it as easy as possible to do things the right way." A third put the order of operations plainly: "The first step is getting the client to see that some kind of AI governance is needed."

The shadow AI governance guide covers the detection methods, the SaaS AI feature audit process, and how to design an approved-tools list that actually reduces shadow adoption.

9. Data Privacy: GDPR, CCPA, and Training Opt-Out

AI tools create two categories of data privacy obligation:

1. Data processing under GDPR/CCPA: When you send personal data to an AI tool, that tool becomes a data processor. GDPR Article 28(3) requires a contract that binds the processor to the controller. Under CCPA, a vendor that processes data for you acts as a service provider under contract with you, and the contract should limit its use of the data. Confirm DPA status before using any AI tool with customer or employee personal data.

2. Training data opt-out: Consumer AI plans can use your prompts to train or improve models unless you opt out, so proprietary business data, client information, or internal communications may become training data. Business and API tiers from the major vendors don't train on your data by default: OpenAI says so for ChatGPT Business, Enterprise, Edu and its API, and Anthropic for its commercial products. Check which tier each person is actually on.

For detailed guidance on which AI APIs and platforms train on your data by default, and which offer genuine privacy-protective terms, see the AI data privacy for small teams guide.

For a head-to-head comparison of AI API providers specifically on privacy commitments, who offers no-training-by-default, who stores prompts, who offers EU data residency, see the privacy-first AI API guide.

California teams and any business deploying AI that generates or processes content for California consumers must also review California SB 942, the California AI Transparency Act, signed September 19, 2024 and made operative August 2, 2026 by AB 853. It requires providers of generative AI systems publicly accessible in California, of any size since SB 1000 deleted the user threshold on September 30, 2026, to offer a free disclosure verification tool and add latent provenance disclosures to AI-generated images, video, and audio. The free AI register template provides a 12-field spreadsheet format for your internal AI inventory. Keep it separate from the EU database registration under Articles 49 and 71, which only providers (and some public-sector deployers) of high-risk systems must complete.

10. Developer AI Tools: Code Assistants and Supply Chain

AI code assistants (GitHub Copilot, Cursor, Codeium, Tabnine) create governance risks that engineering teams often underestimate:

Source code exposure: AI code assistants work by sending code context, your variable names, architecture patterns, internal comments, to AI vendor servers for inference. On personal/free plans, this code may be used to improve vendor models. For proprietary codebases, require Business or Enterprise tier accounts.

IP and licensing risk: Code assistants trained on public repositories can reproduce GPL-licensed code in suggestions. GitHub Copilot has a setting for suggestions matching public code; members of a GitHub Enterprise Cloud organization inherit it from the organization, so set it to block at the org level.

SOC 2 and regulated system compliance: If a developer uses a code assistant in a codebase that touches SOC 2 scope, HIPAA-regulated data, or PCI CDE, the code assistant vendor becomes part of your compliance supply chain. Add it to your vendor register.

The GitHub Copilot and AI code assistant governance guide covers the org-level settings to configure, the acceptable use policy language for engineering teams, and the supply chain implications for regulated codebases.

For teams using Cursor, GitHub Copilot, or any AI code generation tool, the AI code governance guide covers the five rules engineering teams need before the next PR: codebase sensitivity tiers, data protection settings per tool, blocking credentials from AI context windows, human review requirements for AI-generated code, and including code tools in your AI incident log.

For SOC 2 specifically, the AI tools and SOC 2 compliance guide maps which AI tool categories affect which SOC 2 trust service criteria and what evidence auditors will request.

11. Red Teaming and Incident Response

Pre-deployment adversarial testing, red teaming, is the process of deliberately probing an AI system for failure modes before it goes into production. For high-risk AI systems, Article 9 of the EU AI Act requires testing against predefined metrics before the system is placed on the market, and Article 55 requires providers of general-purpose AI models with systemic risk to run and document adversarial testing.

What red teaming covers for business AI:

• Prompt injection attacks (malicious inputs that override system instructions)
• Data extraction attempts (prompts designed to recover training data or system prompts)
• Bias and fairness probing (adversarial inputs targeting demographic edge cases)
• Output reliability under edge cases (unusual inputs that cause confident incorrect outputs)

The red teaming AI systems governance guide provides a structured red team methodology for small teams, specific attack patterns to test for common AI use cases (customer support, document processing, code generation), and a documentation template for EU AI Act risk management compliance.

When a vendor incident occurs, a breach, an unexpected model behavior change, a supply chain compromise, having a response plan in place before the incident reduces exposure time. The AI vendor security incident response guide provides a 72-hour response checklist and the notification chain for vendor-side incidents affecting your deployments.

12. Monitoring and Ongoing Compliance

AI governance is not a one-time implementation. AI models drift, vendor terms change, regulatory requirements evolve, and team AI usage patterns shift. Ongoing monitoring requires:

Monthly review cadence:

• Review any AI-generated decisions that were escalated or reversed
• Check vendor changelog for model updates or policy changes
• Confirm no new shadow AI tools have appeared in use
• Update the AI tool register with any new deployments

For the current state of AI enforcement, the FTC, SEC, state AGs, and EEOC all running simultaneous enforcement actions using existing law, see FTC AI enforcement 2026: what small teams are actually getting fined for. The single highest-impact control: make your AI capability claims accurate and document that they are accurate.

Quarterly:

• Re-run risk assessment for high-risk AI deployments
• Check for regulatory updates (EU AI Act enforcement guidance, CFPB circulars, EEOC guidance)
• Review vendor DPA and BAA status for renewals or changes

Annual:

• Disparate impact testing for any AI used in employment or credit decisions
• Full vendor due diligence refresh for top-5 AI tools
• Policy review and update

The monthly AI governance review checklist provides the metrics and review cadence to use in the monthly review meeting.

The AI governance metrics dashboard covers the lightweight tooling options for small teams to track AI output quality, detect performance drift, and surface anomalies without building a full MLOps infrastructure.

Complete AI Governance Checklist

Immediate (Week 1)

• Complete AI use-case inventory, list every AI tool in use by any team member
• Identify data classification: which tools touch PII, PHI, customer data, or financial data
• Draft AI acceptable use policy using the template
• Assign an AI Governance Lead
• Identify top 3-5 highest-risk AI deployments

Within 30 Days

• Run vendor due diligence on all AI tools handling sensitive data
• Confirm DPA status for GDPR-covered vendors
• Confirm BAA status for any AI vendor touching PHI (healthcare teams)
• Verify training opt-out settings for all AI tools with access to proprietary or customer data
• Run AI risk assessment for highest-risk deployments
• Set up monthly governance review cadence

If Deploying High-Risk AI (EU AI Act Scope)

• Classify each AI tool against EU AI Act Annex III high-risk categories
• Obtain vendor EU Declaration of Conformity for any high-risk AI tools
• Implement human oversight mechanism (ability to override AI decisions)
• Add individual notice language to any AI decision-making workflows
• Document bias testing methodology and results
• Register high-risk AI systems in EU AI database before EU deployment

Sector-Specific

Healthcare:

• Sign HIPAA BAA with every AI vendor that processes PHI
• Classify clinical AI tools against FDA SaMD criteria
• Remove PHI from AI prompts or use minimum necessary standard

HR/Hiring:

• Run 4/5ths disparate impact test on applicant pool
• Add candidate disclosure language to job postings and application forms
• Obtain vendor bias audit methodology and results

Fintech:

• Verify AI credit models produce ECOA-compliant specific reason codes
• Confirm adverse action notices include all ECOA + FCRA elements
• Test for disparate impact across ECOA protected classes

Ongoing

• Monthly: Review escalated AI decisions, check vendor changelogs, confirm no new shadow AI
• Quarterly: Re-run risk assessment, check regulatory updates, verify DPA/BAA renewals
• Annually: Disparate impact testing, full vendor refresh, policy review

Where to Start

If you're starting from zero, the order of operations is:

1. AI governance checklist: understand what you have before building governance around it
2. AI acceptable use policy template: ship a policy baseline this week
3. AI risk assessment: score your existing deployments and identify which need deeper controls
4. AI vendor due diligence checklist, run a vendor review before deploying any new tool
5. Sector-specific guide for your industry if applicable

The AI governance checklist consolidates all the above into a single copy-paste checklist formatted for Notion or Linear.

Our take

Based on the rules cited above, most small teams are not yet in the EU AI Act's high-risk scope, and the dates that will matter to them first are not the headline December 2, 2027 date. They are the US state dates already in force or close: Washington's forged digital likeness rule (June 11, 2026), Maryland's food pricing law and Connecticut's subscription disclosures (October 1, 2026), and Colorado's notice duties (January 1, 2027). The cheapest control is still the one the r/msp thread keeps coming back to: pay for a sanctioned tool that is easier to use than the free one, then write the policy around it. A policy that bans tools without offering a better one is the fastest way to create shadow AI.

How we checked this

We re-checked every date, number, and named law in this guide on October 8, 2026 against primary sources: EUR-Lex for the AI Act and the Digital Omnibus (Regulation (EU) 2026/1744), the eCFR for 29 CFR 1607.4 and 12 CFR 1002.9, the Colorado, Washington, Maryland, and California legislature pages, the NYC DCWP page on Local Law 144, the FDA's clinical decision support guidance page, and the OpenAI and Anthropic BAA help pages. We corrected 19 statements that were out of date, overstated, or wrong, and removed five unsourced numbers, including the Annex III list (medical AI is Annex I, not Annex III), the Washington effective date, and the description of Maryland HB 895. The source log for this page lists each fact with its source and a verbatim quote.

Last reviewed: October 23, 2026. On that date we re-checked the dated facts against the official pages again: the Colorado SB 26-189 history (signed May 14, 2026), the Washington SSB 5886 bill page (effective June 11, 2026), the Maryland HB 895 page (Chapter 154, effective October 1, 2026), the CFPB Circular 2023-03 page (still archived), and the consolidated AI Act for Articles 6(1), 9, 26(11), 55 and 113 and Annex III.

Correction, October 15, 2026: the California section said SB 942 applies to "large" generative AI providers. SB 1000 deleted the Act's user threshold on September 30, 2026, so it now covers providers of any size, and the "AI detection tool" is now called a disclosure verification tool.

Correction, October 23, 2026: the healthcare section said EU AI Act high-risk rules apply to any AI used in clinical diagnosis, treatment or patient management. Medical AI is high-risk when it is a medical device, or a device's safety component, that needs third-party conformity assessment (Article 6(1) and Annex I, from August 2, 2028); emergency patient triage is the Annex III case.

References

• EU AI Act, Annex III: High-risk AI system categories
• NIST AI Risk Management Framework (AI RMF 1.0), risk tiering and controls
• Regulation B, 12 CFR 1002.9, adverse action notices (CFPB Circular 2023-03 is now archived)
• EEOC Technical Assistance: AI in employment selection procedures (withdrawn January 2025; underlying Title VII/ADA disparate impact obligations remain in force)
• HHS HIPAA Business Associate guidance
• Related: AI governance checklist 2026, the 5-component structure and implementation sequence
• Related: AI Risk Assessment for Small Teams, risk scoring matrix and risk register template
• Related: AI Vendor Due Diligence Checklist, 30-question vendor review framework
• Related: Healthcare AI Governance, HIPAA, FDA SaMD, and EU AI Act for clinical teams
• Related: HR AI Governance, EU AI Act Annex III employment, EEOC 4/5ths testing
• Related: Fintech AI Governance, CFPB adverse action requirements, FCRA, EU AI Act credit scoring

Related Reading

• A California Court Coordinated a Dozen-Plus Wrongful Death Cases Against OpenAI

• Microsoft Cut 4,800 Jobs and Called It an AI Story

• Your Coworker Is Fact-Checking You With AI Mid-Conversation

• Amazon KDP AI book surge: enforcement implications for publishers

• Dario Amodei AI regulation proposals June 2026: binding rules, a jobs tax, and what your team should watch

• German court rules Google liable for false AI Overviews: implications for AI deployers

• AI governance metrics dashboard, what to measure

• EU AI Act compliance for small teams, complete guide

• AI coding tools infrastructure risk: what your acceptable use policy must address

• AI vendor due diligence checklist 2026

• AI vendor due diligence in 30 minutes

• Healthcare AI governance, HIPAA + EU AI Act

• AI hiring compliance for small teams: complete guide (NYC LL144, FCRA, EEOC, Colorado 2027)

• Great American AI Act 2026: which state AI laws survive federal preemption?

• EEOC AI hiring guidance 2026, employer checklist

• AI governance for nonprofits 2026

• AI incident reporting regulatory obligations 2026

• SOC 2 AI controls audit 2026

• AI governance metrics and KPIs program 2026

• AI governance Q3 review template 2026

• GenAI Vendor Risk Assessment: A Framework for 2026 (Treasury FS AI RMF

• Generative AI copyright ownership 2026: who owns AI-generated content

• Reviewing AI-Generated Pull Requests: A Review Policy and 9-Point Chec

• Minnesota AI legislation 2026: employer compliance guide

• How to Update Your AI Acceptable Use Policy in 2026: Annual Review Gui

• EU AI Act Digital Omnibus August 2026: will the deadline hold?

• Amazon KDP AI Disclosure Compliance Guide 2026

• One Big Beautiful Bill: federal AI preemption failed, and here's what

• AI in Virtual Data Rooms: Compliance and Governance Guide (2026)

• Texas TRAIGA Biometric AI in Hiring: Consent, Audit, and What HR Teams

• Claude vs ChatGPT for Compliance Teams: 2026 Governance Comparison

• ISO 42001 vs EU AI Act vs NIST AI RMF: which framework applies to your

• EU AI Act Article 9 risk management system: step-by-step implementatio

• AI Models 2x More Likely to Refuse Criticizing Repressive Regimes

• Zoom AI Companion vs Otter.ai vs Fireflies: privacy and compliance com

• AI Training Data Copyright: What the Bartz Ruling Means

• Anthropic recursive self-improvement: what it means for AI governance

• AI governance for HR teams complete guide 2026

• Board AI governance reporting template 2026

• AI governance for legal teams and general counsel 2026

• AI red teaming and security testing requirements 2026

• TypeScript AI agent observability and tracing patterns 2026

• OpenAI's New Deal Policy: 3 AI Governance Steps Every Small Team Must Take

• Pentagon Used Grok AI to Fire 2,000 Missiles: What It Means for Enterprise AI Governance

• Trump's June 2026 AI executive order: what compliance teams and federal contractors must do

• AI Governance for Remote and Distributed Teams: The 2026 Playbook

• AI Adoption Governance: Stop the Quiet Rebellion