#AI governance#EU AI Act#NIST AI RMF#AI compliance#AI strategy#Vendor diligence
Frequently asked questions
- How does the US approach to AI regulation differ from the EU's?
- The US is sectoral and enforcement-led: guidance frameworks like NIST AI RMF combined with agency enforcement (FTC, CFPB, EEOC, FDA depending on the use case) and state-level privacy laws. The EU is horizontal and risk-based: the AI Act assigns obligations by risk tier (unacceptable, high-risk, limited, minimal) on top of GDPR and other digital rules, with stronger emphasis on documentation, logging, and human oversight.
- If we operate in both the US and EU, do we need two compliance programs?
- No. Build once to the higher bar - usually the EU AI Act's documentation, oversight, and data-governance requirements - and apply the same controls in both jurisdictions. Keep governance lightweight: role hats, a one-page decision rights matrix, and a 2-3 page documentation pack per workflow. Two parallel programs cost more and create gaps.
- What metrics prove we're managing AI responsibly?
- Track adoption (% of eligible tasks running through the governed workflow), exception rate (escalations to human review), quality (accuracy and compliance vs. baseline), latency, MTTR after incidents, privacy and security events (access violations, blocked data exports), and a change log of model, provider, and template changes with their measured impact.
