Ready Before the Regulator Asks: The AI Compliance Readiness Playbook
A WorkplaceAI Strategy Playbook
Deadlines slip, laws get rewritten, and federal and state governments disagree. The work that gets you ready does not change much. Here is how to build one compliance program that holds up across all of it.
This playbook is written for business leaders, not lawyers. It describes a practical readiness program and summarizes where major rules stood in October 2026. It is not legal advice, and the summaries move quickly, so confirm specifics with counsel before relying on them.
The central argument is simple. You do not need a separate effort for every statute. You need an inventory, a risk tiering, clear owners, vendor evidence, notices and human review where decisions matter, records, trained people, and an incident plan. Done once, that foundation maps to most of what regulators ask.
Three things make AI compliance feel unmanageable. All three are real, and all three can be handled.
Waiting for stability is not a plan. If the rules were settled tomorrow, you would still need the inventory, the owners, and the records. Start with those.
The table below summarizes major developments. It reflects public reporting and law-firm summaries available as of this writing, and it will date quickly.
| Jurisdiction | Where it stands | What it means for you |
|---|---|---|
| EU AI Act, Digital Omnibus (Regulation (EU) 2026/1744) | Adopted and in force from July 27, 2026, per Usercentrics. Stand-alone high-risk obligations moved from August 2, 2026 to December 2, 2027. Obligations for AI built into regulated products moved to August 2, 2028. | Most high-risk duties arrive later, but the work to classify and document takes a long time. Start now. |
| EU AI Act, transparency (Article 50) | Not delayed. Obligations begin August 2026. Watermarking of generated content gets a grace period to December 2, 2026 for systems already on the market. A new ban on systems that generate non-consensual intimate imagery and child sexual abuse material also applies from December 2, 2026. | If you deploy chatbots or generate synthetic content for EU users, transparency duties are current. See our Compliance Watch on Article 50. |
| EU AI Act, general-purpose models and AI literacy | Model-provider duties have applied since August 2025. The AI literacy duty has applied since February 2025, and the Omnibus softens it to supporting staff literacy. | Provider and deployer duties differ. Staff training is already expected. |
| Colorado | The original AI Act (SB 24-205) was repealed and replaced by SB 26-189, signed May 14, 2026. The new Automated Decision-Making Technology Act takes effect January 1, 2027 if the attorney general completes rulemaking by then. It centers on notice, adverse-outcome explanation, data access and correction, and human review for consequential decisions. It drops the duty of care, impact assessments, and risk management program requirements. | Plan for notices and review rights, with records kept for three years. Enforcement is by the attorney general only, up to $20,000 per violation. See our Compliance Watch on Colorado. |
| California | Employment regulations on automated decision systems took effect October 1, 2025. Privacy regulations on automated decision-making technology require pre-use notice, opt-out, and access rights, with existing users given until January 1, 2027 to comply, per Akin Gump. Risk assessments are required for significant decisions. | If you use automated tools in hiring or other significant decisions affecting California residents, notices and opt-outs are in scope. Penalties run to $2,500 per violation, or $7,500 if intentional. |
| Illinois | HB 3773 took effect January 1, 2026. It requires notice when AI influences covered employment decisions and bars discriminatory use. Implementing rules from the Department of Human Rights were still in draft in the source reviewed. | Employers should post notices and keep records. Draft rules call for four-year retention. |
| Texas | The Responsible AI Governance Act took effect January 1, 2026. It is intent-based, enforced by the attorney general alone, with a 60-day cure period and a safe harbor for entities following the NIST AI Risk Management Framework or a comparable one. | A recognized framework has direct legal value in Texas. |
| Federal U.S. | A December 2025 executive order created a litigation task force to challenge state AI laws. The White House asked Congress in March 2026 for broad preemption. State laws remain in force unless Congress acts or a court rules otherwise. The Justice Department intervened in xAI’s April 2026 suit against Colorado. | Do not assume federal action will remove state duties. Plan for the state laws that exist. |
Two cautions apply. First, vendor summaries and law-firm alerts sometimes disagree on details, such as exact compliance dates. Where I relied on a single source, the table says so. Second, this table covers the headline laws only. Sector rules in finance, health care, insurance, and employment can apply to you with no AI-specific statute at all.
Different laws use different words, but they ask for a similar set of things. They want to know what AI you use, what decisions it affects, who is responsible, what you told the people affected, how a human can intervene, and what records prove it.
That commonality is your advantage. Build one program around those questions, then map it to each law as it comes into force. When a date moves, the map changes. The program does not.
Everything else in this playbook supports one of those four moves.
The eight stages below build the program in order. The first four create visibility and control. The last four create the evidence.
Start by finding out what you have. Most organizations undercount, because AI arrives through four doors.
Collect it three ways: Ask department heads, review procurement and software spend, and review network or identity logs for AI services. Employees usually tell you more when the goal is safe use, not punishment.
Treat the inventory as a living record. A quarterly refresh with a clear owner will catch what a one-time survey misses.
Not every use needs the same controls. A grammar checker and a hiring screen are different problems. Sort uses into tiers so effort goes where the exposure is.
| Tier | Typical examples | Minimum expectations |
|---|---|---|
| High | Employment, lending, insurance, housing, health care, education, or benefits decisions. Systems that materially influence those decisions. Uses that affect minors or involve biometric or sensitive data. | Named owner, documented purpose, notice to affected people, human review and override, testing for bias and accuracy, vendor documentation, records, and periodic reassessment. |
| Medium | Customer-facing chatbots, content generation shared externally, fraud and risk scoring that a person reviews, agents that act on company systems. | Disclosure that AI is in use, content and accuracy checks, logging, an escalation path, and vendor terms covering data use. |
| Low | Internal drafting, summarizing, research, code assistance with review, and meeting notes. | Acceptable-use policy, approved tools list, no restricted data, and staff training. |
Judge by the decision, not the technology. The same model can be low risk when it drafts an internal memo and high risk when it ranks job applicants. Colorado’s revised law and California’s regulations both focus on consequential or significant decisions, which is the same logic.
Note which EU category might apply too, if you serve EU users. Prohibited practices, high-risk categories, transparency duties, and general-purpose model duties are separate buckets with different dates.
Every system in the medium and high tiers needs a named person who answers for it. A committee is not an owner.
Give owners authority to pause a system. If the person accountable cannot stop a use when problems appear, the accountability is nominal.
The Agent Governance Playbook covers ownership, boundaries, and off switches for autonomous agents in more detail. Use it alongside this one if you run agents.
Most organizations deploy AI built by someone else. The law generally still holds the deployer responsible for how it is used. Colorado’s revised law explicitly separates developer duties, such as documentation, from deployer duties, such as notice. The deployer has to ask for what it needs.
Put these in the contract. A questionnaire answered once and filed is weaker than an obligation that renews with the agreement. Treat vendor claims, including compliance claims, as assumptions until you test them.
If a vendor will not provide documentation for a high-tier use, that is itself a finding. Consider a different supplier, or limit the use.
For high-tier uses, the common thread across Colorado, California, Illinois, and the EU is that affected people should know about the AI, and a person should be able to intervene.
A human in the loop only counts when the human can actually change the outcome. Check that reviewers have the time, information, training, and authority to disagree with the system.
Rules on opt-outs and appeals vary. California includes an opt-out right for covered automated decisions. Colorado provides for human review and reconsideration of adverse outcomes. Build the process once, then adjust the labels and timelines by jurisdiction.
When a regulator, a plaintiff, or a customer asks about an AI system, the first question is usually for documents. Records that exist only in someone’s memory do not help.
| Record | What it should show |
|---|---|
| System file | Purpose, owner, tier, vendor, version, data used, and approval date. |
| Risk assessment | Foreseeable harms, who could be affected, and the controls chosen. California requires one for significant-decision systems, with updates after material changes. |
| Testing results | Accuracy, bias, and robustness testing, with method, date, and findings. Repeat after material changes. |
| Notices issued | What was disclosed, to whom, when, and where it was posted. |
| Review log | Human reviews, overrides, and appeals, with outcomes. |
| Change log | Model, prompt, configuration, and policy changes, and who approved them. |
| Vendor file | Contracts, documentation, test evidence, and incident commitments. |
| Incident record | What happened, how it was found, what was done, and what changed. |
Retention periods differ. Colorado’s revised act calls for at least three years, and Illinois draft rules call for four. Set a single retention period at the longer end, and confirm it with counsel.
Testing for bias deserves care. Some laws shifted from outcome-based duties toward intent or disclosure, and federal challenges have targeted disparate-impact approaches. Even so, anti-discrimination statutes that predate AI still apply to automated decisions. Test regardless, because a discriminatory result is a business and legal risk however the AI rules evolve.
The EU has expected AI literacy among staff since February 2025, and its Omnibus softened the wording to supporting literacy rather than guaranteeing a level. The direction is clear anyway. People who use AI should understand its limits, the rules, and when to escalate.
Keep a record of who completed what and when. The AI Adoption and Change Management Playbook covers how to make training stick.
Things will go wrong. A system will produce a harmful output, expose data, or act outside its limits. How you respond is part of compliance.
The past year has shown that regulators are moving from questions about policy to requests for evidence. Eight state attorneys general sued one AI company, the FTC issued subpoenas, and the EU AI Office is questioning labs. Our reports on AI Under Assault and on AI incident reporting cover the details.
Run a tabletop exercise once a year with a realistic scenario, such as a biased hiring result or a chatbot giving harmful advice. The gaps show up quickly.
Recognized frameworks give structure and can provide legal value. Do not adopt one for decoration. Pick one that you will actually use.
| Framework | What it offers | Where it helps |
|---|---|---|
| NIST AI Risk Management Framework | A voluntary structure for governing, mapping, measuring, and managing AI risk. | Texas’s law provides a safe harbor from civil penalties for entities following it or a comparable framework, per Haynes Boone’s summary. It also gives a common vocabulary. |
| ISO/IEC 42001 | A certifiable management system standard for AI. | Useful when customers or partners ask for external assurance. |
| EU AI Act requirements and standards | Legal duties by risk category, with technical standards being developed. | Required for covered uses. Align early where you serve EU users. |
Frameworks do not replace legal analysis, and following one is not the same as being compliant. Treat them as scaffolding for the program above.
This example uses invented details. It is not drawn from a real company, and it is not a legal conclusion.
A 600-person staffing firm uses an AI screening feature built into its applicant tracking system. It also has recruiters using an assistant to draft outreach, and a chatbot that answers candidate questions. It hires in Illinois, California, and Colorado, and places some candidates with EU clients.
The firm does not build a separate program for each state. It builds one, then adds the Illinois posting, the California opt-out process, and the Colorado explanation step as variations.
| Failure | What it looks like | Fix |
|---|---|---|
| Waiting for clarity | No work starts because the rules keep changing. | Build the inventory, tiers, and owners now. |
| Policy without inventory | A written policy covers tools nobody has listed. | Find the real uses first. |
| Vendor trust | Compliance is assumed because the supplier says it is covered. | Request documentation and put duties in the contract. |
| Rubber-stamp review | A person approves every output in seconds. | Give reviewers time, information, and authority, and track overrides. |
| Notices buried | Disclosures sit in a footer no one reads. | Place notices where decisions are made. |
| Records on demand | A regulator asks, and the answers live in email threads. | Keep a system file and a change log from the start. |
| Compliance as a one-time project | A review is done and filed. | Refresh the inventory and tiers quarterly. |
| Ignoring older laws | Teams focus on AI statutes and miss employment, consumer, and privacy law. | Ask counsel which existing laws already cover each use. |
Check each item for your highest-tier uses. A gap is a task, not a verdict.
Do the high-tier uses first and the rest later. A complete record for three important systems is worth more than a thin record for thirty.
The rules will keep shifting. Some dates will slip again, some laws will be rewritten, and courts will weigh in. None of that changes the foundation: Know what you use, know what it decides, know who owns it, and be able to show your work.
Start with the inventory this month. It is the one step every rule requires, and the one most organizations have not finished.
Our Compliance Watch reports track the rules as they move, and the companion playbooks cover agent controls, adoption, and measurement. This guide is general information, not legal advice. Confirm specifics with qualified counsel.
Agent Governance Playbook → AI Adoption Playbook → AI ROI Measurement Playbook → Compliance Watch: Colorado → Compliance Watch: EU Article 50 →Sources: Gibson Dunn, EU AI Act Omnibus Agreement (May 27, 2026). Usercentrics, EU AI Act Deal: Digital Omnibus Now in Force (adoption, signature, and entry into force dates; the page carries an internal inconsistency in its metadata, so confirm against the Official Journal). Skadden, Colorado Repeals and Replaces Its AI Act (June 9, 2026). Akin Gump, New California Regulations Regarding Employer Use of Automated Decision-Making Technology (December 16, 2025). Hinshaw & Culhane, Illinois Adopts New AI in Employment Regulations. Haynes Boone, Texas Responsible Artificial Intelligence Governance Act: What Businesses Need to Know (September 9, 2025). Ropes & Gray, White House Legislative Recommendations (March 2026). Barnes & Thornburg, DOJ Intervenes in Lawsuit Challenging Colorado’s Algorithmic Discrimination Law (2026). The walkthrough uses invented details for illustration only. This playbook is general information as of October 2026, not legal advice, and law-firm summaries were not independently checked against statutory text.