AI compliance fundamentals
Domain 1: AI compliance fundamentals
This domain tests whether you can define AI compliance, separate legal duties from ethical expectations, and describe the elements of a compliance programme across the AI lifecycle. Questions often ask you to classify an obligation, identify the correct compliance response, or spot a control gap in a scenario.
Core rules and concepts
- AI compliance means conforming to binding law, regulation, standards, contractual commitments and voluntary codes that apply to an AI system. Ethics principles inform compliance but are not automatically enforceable.
- The OECD definition is widely used: an AI system is a machine-based system that infers, from the input it receives, how to generate outputs such as predictions, content, recommendations or decisions, with varying levels of autonomy and adaptivity.
- Scope depends on role: provider, deployer, importer, distributor, authorised representative or user. Obligations differ by role, jurisdiction and risk level.
- A credible programme covers governance and policy, legal register, risk assessment, data protection, transparency, human oversight, security, record-keeping, incident response, training, monitoring, audit and remediation.
- Documentation must be created before and during deployment, not retrofitted. Keep model cards, data statements, impact assessments, test evidence, decision logs and vendor assurances.
- Compliance is risk-based. Not every AI system triggers the same duties; classification drives controls.
Worked example
A bank deploys a chatbot that answers account questions and occasionally recommends products. It processes personal data and interacts directly with customers. The compliance analysis should identify: a lawful basis and transparency notice under data protection law; disclosure that the user is interacting with AI where required; contractual controls over the vendor model; logging and human escalation for complaints; a data protection impact assessment if the processing is high-risk; and monitoring for inaccurate or discriminatory outputs. The reasoning is role- and risk-based, not technology-first.
Traps
- Treating ethical principles as legally binding without a legal hook.
- Assuming every AI system is high-risk, or that a low-risk label removes all duties.
- Confusing model accuracy with compliance; an accurate model can still breach transparency, privacy or fairness rules.
- Ignoring third-party providers and open-source components.
- Writing policies without evidence of operation.