Sefism.AI governance: Technical

Tauseef Fayyaz

Chapter 01

Regulations and frameworks

The laws, standards and principles that shape AI governance, what each one is for, how binding it is and the dates that matter, as of October 2026.

EU AI Act

Also called Regulation (EU) 2024/1689, Artificial Intelligence Act, AI Omnibus

What: The EU law that regulates AI by risk, with duties for providers and deployers. It entered into force on 1 August 2024 and applies in phases; the AI Omnibus, in force since 27 July 2026, delayed the high-risk rules.
Why: It applies to anyone whose AI is used in the EU, wherever they are based, and its structure is copied by many other frameworks. Most governance mappings start here.

Code

Date         What applies (as of Oct 2026)
1 Aug 2024   Act enters into force
2 Feb 2025   Prohibitions, AI literacy duty
2 Aug 2025   GPAI model duties, governance rules
2 Aug 2026   Most other rules, transparency, GPAI fines
2 Aug 2027   GPAI models placed on market before Aug 2025
2 Dec 2027   High-risk systems in Annex III areas
2 Aug 2028   High-risk AI in regulated products (Annex I)

Watch out

Quoting 2 August 2026 for high-risk systems: that date moved in July 2026.

AI Act risk tiers

Also called high-risk AI, Annex III, transparency risk, minimal risk

What: Four levels: unacceptable (banned), high risk (strict requirements such as risk management, data governance, logging, oversight and accuracy), transparency risk (disclose AI use or generated content) and minimal risk (no new duties).
Why: The tier decides how much work a system needs. High-risk areas in Annex III include biometrics, critical infrastructure, education, employment, credit, essential services, migration and justice.
Example: A CV ranking tool is high risk, a customer service chatbot is transparency risk, and a spam filter is minimal risk.

Watch out

Tiering by the technology instead of the use: the same model can be minimal risk in one product and high risk in another.

Prohibited AI practices

Also called Article 5, banned AI

What: Uses banned since 2 February 2025, such as harmful manipulation, exploiting vulnerabilities, social scoring, crime prediction from profiling alone, untargeted facial scraping, emotion recognition at work or school, and sensitive biometric categorisation.
Why: Fines for prohibited practices are the highest in the Act. The 2026 amendment added AI that generates non-consensual intimate imagery or child sexual abuse material.

Watch out

Assuming the bans only matter to governments: workplace emotion recognition and scraping bans hit ordinary companies.

General-purpose AI model obligations

Also called GPAI, systemic risk, Code of Practice

What: Duties for providers of models that can do many tasks: technical documentation, information for downstream builders, a copyright policy and a public training content summary. Models with systemic risk (presumed above 10^25 FLOP) must also evaluate, red-team, report incidents and secure the model.
Why: They applied from 2 August 2025, with Commission fines possible from 2 August 2026. A voluntary Code of Practice is one way providers show compliance.

Watch out

Copying a model provider's duties onto an app team that only builds on someone else's model.

NIST AI RMF

Also called AI Risk Management Framework, NIST AI 100-1, NIST AI 600-1, Generative AI Profile

What: A free, voluntary US framework (version 1.0, January 2023, under revision as of 2026) with four functions: Govern, Map, Measure and Manage. Its Generative AI Profile (NIST AI 600-1, July 2024) covers risks specific to generative AI.
Why: It is the most widely used vocabulary for organising AI risk work, including outside the US, and it is free.
Example: Naming an owner is Govern, describing who a system affects is Map, fairness testing is Measure and deciding to retire a model is Manage.

Watch out

Treating it as a checklist to tick rather than a way to organise decisions and evidence.

ISO/IEC 42001

Also called AIMS, AI management system, ISO 42001

What: The international standard (December 2023) for an AI management system: policies, roles, risk and impact assessment, Annex A controls, internal audit and improvement. Organisations can be certified against it.
Why: Enterprise customers ask about it, and it shares a structure with ISO/IEC 27001, so security teams adopt it quickly. Related: ISO/IEC 42005 (impact assessment) and 42006 (certification bodies).

Watch out

Assuming certification proves EU AI Act compliance: map the legal duties separately.

OECD AI Principles

Also called OECD AI Recommendation

What: The first intergovernmental AI standard, adopted 2019 and updated May 2024: five values (inclusive growth, human rights and fairness, transparency, robustness and safety, accountability) and five recommendations for governments.
Why: Many national policies borrow their language, and the EU AI Act's definition of an AI system follows the OECD's, so they help you read any framework.

Watch out

Citing them as binding rules: they are principles, with no checklist or enforcement.

Pakistan and India AI policies

Also called National AI Policy 2025, India AI Governance Guidelines, MeitY guidelines

What: Pakistan's National AI Policy 2025 (cabinet approval July 2025) focuses on adoption, skills and a secure AI ecosystem. India's AI Governance Guidelines (MeitY, 5 November 2025) are voluntary, with seven principles and new advisory bodies.
Why: Neither creates an AI-specific law, so existing laws, such as India's IT Act and Digital Personal Data Protection Act, and sector regulators still govern AI there.

Watch out

Reading "no AI law" as "no obligations" when data protection and sector rules still apply.

UAE and Saudi AI principles

Also called UAE AI Charter, SDAIA AI Ethics Principles

What: The UAE Charter for the Development and Use of AI sets twelve principles, including safety, algorithmic bias, privacy, transparency and human oversight. Saudi Arabia's SDAIA published AI Ethics Principles 2.0 in September 2023 with seven principles applied across the AI life cycle.
Why: Gulf employers and government clients use them as the reference for responsible AI work, alongside each country's data protection law.

Watch out

Treating principles as optional extras in government projects, where clients often write them into contracts.

Framework comparison

Also called AI regulation comparison, law vs standard vs principles

What: A side-by-side view of the main AI rules by type, scope and whether they can be certified, as of October 2026.
Why: Most organisations combine them: one law to comply with, one standard to certify against and one framework to organise risk work.

Code

Name         Type          Binding    Certifiable
EU AI Act    EU law        Yes        Conformity check
NIST AI RMF  US framework  No         No
ISO 42001    Standard      No         Yes, audited
OECD         Principles    No         No
India AIGG   Guidelines    No         No
Pakistan     Policy        No         No
UAE Charter  Principles    No         No
SDAIA 2.0    Principles    No         No

Watch out

Running three separate compliance projects instead of one mapping with extra columns per framework.

Go deeper