4.2.2. Regulatory Compliance Risks for AI-Enabled Processes
💡 First Principle: Laws that existed before AI still apply when AI is involved. Discrimination is illegal whether a person or a model discriminates; personal data rules apply whether a clerk or an algorithm processes the data. New AI-specific laws add obligations on top, scaled to risk. A strategist's job is to identify which rules attach to a business process once AI enters it, before the process changes.
Regulatory exposure in AI-enabled processes typically comes from several families of rules:
| Rule family | What it governs | AI-specific risk |
|---|---|---|
| AI-specific regulation (for example, the EU AI Act) | Obligations scaled to risk tier: prohibited practices, requirements for high-risk systems (risk management, data governance, documentation, human oversight, accuracy, logging), and transparency duties (for example, telling people they are interacting with AI or that content is AI-generated) | Using AI in a regulated category (employment, credit, education, essential services) without meeting high-risk requirements; failing transparency duties |
| Data protection and privacy (for example, GDPR and other privacy laws) | Lawful basis, purpose limitation, data minimization, rights of individuals, and rules on solely automated decisions with significant effects | Using personal data to train or prompt models beyond its original purpose; automated decisions without human involvement or explanation; cross-border data transfer |
| Anti-discrimination and consumer protection | Fair treatment in lending, housing, employment, insurance; truthful advertising; fair practices | Biased outcomes; misleading AI-generated claims; inability to give reasons for adverse decisions |
| Sector regulation | Financial services, healthcare (for example, HIPAA in the US), insurance, critical infrastructure | Model risk management expectations, record-keeping, use of protected health information |
| Intellectual property and contract law | Copyright, licensing, confidentiality | Training on or generating protected content; disclosing confidential data to third-party tools |
Under the EU AI Act, obligations are phased. Prohibited practices and AI literacy obligations already apply, as do obligations for general-purpose AI model providers. Following the 2026 Digital Omnibus amendments, obligations for most stand-alone high-risk systems (Annex III, such as employment and credit) apply from 2 December 2027, with high-risk AI in regulated products (Annex I) following later. Dates will continue to evolve; the exam tests the risk-based logic, not the calendar.
Identifying and addressing compliance risk in practice:
- Map the process and its jurisdictions: where are affected people located, what decisions does AI influence, what data does it use?
- Classify the use case against applicable regulation (4.2.4).
- Engage legal, compliance, and privacy early, at intake (governance by design).
- Implement required controls: human oversight, documentation, transparency notices, data protection impact assessments, record-keeping.
- Assign accountability and monitor for regulatory change.
⚠️ Exam Trap: Introducing AI into a process does not remove existing legal obligations, and a vendor's compliance does not transfer to your use case. When a scenario involves AI influencing decisions about people (hiring, credit, insurance, access to services), expect the best answer to include legal and compliance review, human oversight, transparency to affected individuals, and data protection controls.
Reflection Question: A European retailer wants to use AI to screen job applicants and automatically reject the lowest-ranked 50%. Which regulatory families apply, and what changes to the design would you require before approving it?
