EXIN AI Compliance Professional cheat sheet

AI compliance = conforming AI system behavior and documentation to binding law, contract, and voluntary standard simultaneously; law sets the floor, standards often set the operational bar.

Three recurring legal anchors: product safety (defects, foreseeable misuse), data protection (lawful basis, purpose limitation, data subject rights), and non-discrimination (equal treatment, disparate impact testing).

Scope test: an AI system is a machine-based system producing outputs such as predictions, content, recommendations, or decisions that influence physical or virtual environments; determinism is not required.

Risk-tier logic: obligations scale with the severity and reversibility of harm and with the autonomy of the system, not with the size of the model or the vendor's brand.

Prohibited-practice categories typically include social scoring by public actors, manipulative techniques exploiting vulnerability, untargeted facial scraping, emotion inference in workplace or education, and certain biometric categorization.

Documentation duty chain: system description, intended purpose, foreseeable misuse, training data provenance, validation results, known limitations, and human oversight design.

Transparency triggers: user interaction with AI, synthetic content generation, emotion recognition, biometric categorization, and deepfake publication each require a distinct disclosure form.

General-purpose model duties differ from deployer duties: providers document training, publish summaries, and manage copyright policy; deployers ensure lawful use and human oversight.

Evidence hierarchy: logs and test records outrank policy statements; a control that cannot be evidenced is treated as absent in an audit.

EU AI Act: risk-based, extraterritorial when output is used in the EU; provider, deployer, importer, distributor, and authorized representative are distinct roles with distinct duties.

EU AI Act prohibited practices apply first, then high-risk obligations (risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy, robustness, cybersecurity).

GPAI obligations: technical documentation, information to downstream providers, copyright compliance policy, and a training-content summary; systemic-risk models add evaluation, adversarial testing, incident reporting, and cybersecurity.

NIST AI RMF functions: Govern, Map, Measure, Manage; Govern is cross-cutting and continuous, and the framework is voluntary and outcome-based, not certifiable.

ISO/IEC 42001 is a certifiable management-system standard (plan-do-check-act on AI), auditable like ISO 27001; ISO/IEC 23894 gives AI-specific risk management guidance.

OECD AI Principles: inclusive growth, human rights, transparency, robustness, and accountability; they are the common reference behind many national strategies.

Sector regulators retain authority: financial supervisors, medical device regulators, and employment authorities apply existing rules to AI outputs in their domains.

Governance design rule: assign one accountable owner per AI system, a documented approval gate before deployment, and a periodic re-approval trigger on material change.

Cross-border rule: the strictest applicable regime governs the system when the same output reaches users in multiple jurisdictions; document the mapping.

Risk = likelihood x impact, assessed per use case and per affected population; a model that is low risk in one context can be high risk in another.

Core harm families: accuracy and reliability, bias and fairness, privacy, security and adversarial manipulation, safety and physical harm, transparency, and human-autonomy erosion.

Bias testing requires disaggregated metrics by protected group; aggregate accuracy can hide subgroup failure, so report per-group precision, recall, and error rates.

Fairness metrics conflict: demographic parity, equalized odds, and calibration cannot generally all hold at once; the choice must be justified by the use case and documented.

Human oversight control types: human-in-the-loop (approval required), human-on-the-loop (monitoring with override), and human-out-of-the-loop (post-hoc review only); select by reversibility of harm.

Robustness controls: out-of-distribution testing, adversarial and prompt-injection testing, red teaming, rate limiting, input validation, and fallback behavior on low confidence.

Privacy controls: data minimization, purpose limitation, de-identification, retention limits, and training-data exclusion or opt-out handling.

Drift control: monitor input distribution, output distribution, and performance; define thresholds that trigger retraining, rollback, or suspension.

Model inventory fields: intended purpose, owner, risk tier, data sources, dependencies, evaluation results, approval date, and next review date.

Three-lines model: business owns AI risk, compliance and risk functions set and test controls, internal audit provides independent assurance.

Accountability artifacts: AI policy, system inventory, risk assessment records, approval decisions, evaluation reports, incident logs, and training records.

Incident process stages: detect, triage and classify severity, contain (disable, throttle, roll back), notify per legal deadlines, remediate, and record lessons learned.

Serious-incident reporting to authorities is time-bound and usually follows awareness of the event, not the date of full root-cause analysis; start the clock at detection.

Vendor due diligence: request model documentation, evaluation results, subprocessor list, data-use terms, change-notification commitments, and audit or termination rights.

Change management rule: retraining, new data sources, prompt or model version changes, and new markets each re-trigger risk assessment proportionate to the change.

Monitoring metrics: override rate, escalation rate, complaint volume and themes, drift indicators, and percentage of systems with current evaluations.

Training obligations differ by role: developers need fairness and testing literacy; deployers need limitation awareness and escalation paths; executives need oversight duties.

Audit readiness: every control maps to a requirement, an owner, an evidence source, and a test frequency; gaps are logged with remediation dates.