Our certification framework maps directly to the binding AI governance obligations of five major jurisdictions. One certification. Five regulatory frameworks covered.
Regulation 2024/1689: prohibitions in force, high-risk obligations from 2026
The EU AI Act is the world's first comprehensive binding AI law. It imposes conformity assessments, technical documentation requirements, human oversight obligations, and EU database registration for high-risk systems. Our framework covers all mandatory categories including Annex III high-risk use cases, plus conditional categories for public sector, law enforcement, and justice contexts.
AI used in hiring, CV screening, candidate scoring, and interview analysis. Annex III high-risk category requiring conformity assessment and human oversight documentation.
AI in creditworthiness assessment, loan decisioning, and risk pricing for insurance products. Annex III high-risk category with strict transparency and explainability requirements.
Formal processes for identifying, escalating, and reporting serious AI-related incidents to competent authorities. Covers incident classification, internal escalation, and regulatory notification timelines.
Our complete framework covers all 25 EU AI Act categories including every Annex III high-risk use case. Request the full mapping to see exactly how your certification covers your regulatory exposure.
Request Full Mapping
PIPEDA & Federal AI Governance Framework
Canada's Artificial Intelligence and Data Act (AIDA) died on the order paper in January 2025 when Parliament prorogued. Our framework is built on existing binding obligations and AIDA's stated intent — ensuring full readiness when federal AI legislation is reintroduced. Canadian organisations in finance, healthcare, and employment face real obligations today.
AI systems making or recommending administrative decisions affecting individuals without meaningful human review. Governed by the federal Directive on Automated Decision-Making and PIPEDA fairness principles.
Identifying, measuring, and mitigating discriminatory outcomes in AI systems. Aligned with the Canadian Human Rights Act prohibition on discrimination based on protected grounds.
Governance of AI provided by vendors, partners, and subcontractors. Covers contractual obligations, due diligence requirements, and accountability for third-party AI outputs under PIPEDA.
Our complete framework covers all 11 Canadian categories including sector-specific requirements for financial services under OSFI E-23, healthcare under provincial privacy laws, and employment under Ontario Bill 194.
Request Full Mapping
NIST AI Risk Management Framework 1.0 — 2023
The US has no federal AI law. Our framework is anchored to NIST AI RMF 1.0 as the de facto national standard, supplemented by sector-specific federal regulations and state-level AI legislation including Illinois, Texas, and Colorado's incoming framework (effective 2027). The framework is designed to adapt as federal AI legislation develops.
Systematic identification, assessment, and documentation of AI risks across the system lifecycle. Aligned with NIST AI RMF MAP and MEASURE functions covering risk categorisation and impact assessment.
Detecting, measuring, and mitigating discriminatory outcomes. Aligned with EEOC algorithmic discrimination guidance, FTC unfair practice standards, and NIST AI RMF fairness characteristic.
Governance of AI models and systems provided by vendors, cloud providers, or partners. Aligned with NIST AI RMF supply chain risk management and OCC guidance on third-party AI relationships.
Our complete framework covers all 11 US categories including sector-specific requirements for financial services under OCC SR 11-7, healthcare under FDA SaMD and HIPAA, employment under EEOC guidance, and biometric data under Illinois BIPA.
Request Full Mapping
UAE AI Charter 2024 & PDPL
The UAE operates a layered governance model: federal law, emirate-level regulation, and free zone frameworks. Our framework addresses Dubai-specific obligations under the PDPL and the UAE AI Charter's 12 principles. Organisations in DIFC or ADGM free zones face additional requirements under their independent legal frameworks, which our conditional categories cover.
AI systems collecting, processing, or storing personal data of UAE residents. Covers lawful processing basis, data minimisation, purpose limitation, and individual rights under Federal Decree-Law No. 45 of 2021.
Formal governance structures, accountability mechanisms, and AI risk management policies. Aligned with the UAE AI Charter 2024 governance principle and Dubai Ethical AI Toolkit accountability requirements.
Mechanisms ensuring meaningful human review and intervention capability for AI systems making consequential decisions. Aligned with UAE AI Charter 2024 human oversight principle.
Our complete framework covers all 10 UAE categories including sector-specific requirements for financial services under CBUAE and DFSA Enabling Technologies Guidelines, healthcare under Dubai Health Authority AI Policy, and government and smart city AI under Dubai AI Strategy.
Request Full Mapping
revFADP & Council of Europe AI Convention
Our framework is built directly on primary legislative texts and official regulatory guidance. The documents below are the authoritative sources underpinning every assessment category.
European Union
Canada
United States
United Arab Emirates
Switzerland
Book a 30-minute discovery call. We will identify your jurisdiction exposure, show you exactly which categories apply, and outline the fastest path to certification.
Book Discovery Audit