AI Dictionary of Terms

Compliance

The practice of ensuring AI systems adhere to legal regulations, industry standards, and organizational policies — encompassing data privacy (GDPR, HIPAA), AI-specific regulations (EU AI Act), sector-specific requirements (finance, healthcare), and internal governance frameworks.

The Simple Version

Imagine you’re building a new restaurant. You can’t just open the doors and start serving food. You need to comply with health codes (food safety), building codes (fire exits, accessibility), labor laws (minimum wage, working conditions), and business licenses.

Compliance in AI is similar. You can’t just deploy an AI system and hope for the best. You need to ensure it complies with:

Non-compliance can result in massive fines, lawsuits, reputational damage, and even criminal liability.

Detailed Explanation

AI compliance is a multi-layered challenge that spans legal, technical, and organizational domains.

Key Regulatory Frameworks:

1. Data Privacy:

2. AI-Specific Regulations:

3. Industry-Specific Requirements:

Compliance Challenges for AI:

1. Explainability:

2. Bias & Fairness:

3. Data Governance:

4. Human Oversight:

5. Transparency:

Key Characteristics

Business Context

Compliance is non-negotiable for enterprise AI deployment:

Why Compliance Matters:

Compliance Strategy:

Compliance by Risk Level (EU AI Act):

Risk Level Examples Requirements
Unacceptable Social scoring, manipulative AI Banned
High Medical devices, autonomous vehicles Conformity assessment, human oversight, transparency
Limited Chatbots, deepfakes Transparency obligations (disclose AI use)
Minimal Spam filters, video games No specific requirements (best practices recommended)

Cost of Compliance:

ROI of Compliance:

Real-World Analogy

Building a house. You need permits (regulations), inspections (audits), and to follow building codes (standards). It’s more expensive and time-consuming than just building without permits, but if you skip compliance, you risk fines, forced demolition, or even injury. Compliance in AI is similar — it’s an investment that protects you from much larger risks.

Code Example

# Compliance checking for AI outputs (conceptual)
import re
from typing import Dict, List

class ComplianceChecker:
    def __init__(self):
        # Define compliance rules
        self.pii_patterns = {
            "ssn": r"\b\d{3}-\d{2}-\d{4}\b",  # Social Security Number
            "credit_card": r"\b\d{4}[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}\b",
            "email": r"\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b"
        }
        
        self.restricted_topics = [
            "medical advice", "financial advice", "legal advice"
        ]
    
    def check_compliance(self, prompt: str, response: str) -> Dict:
        """Check if AI output complies with regulations."""
        violations = []
        
        # 1. Check for PII (GDPR, HIPAA compliance)
        for pii_type, pattern in self.pii_patterns.items():
            if re.search(pattern, response):
                violations.append(f"PII detected: {pii_type}")
        
        # 2. Check for restricted topics (industry regulations)
        for topic in self.restricted_topics:
            if topic in response.lower():
                violations.append(f"Restricted topic: {topic}")
        
        # 3. Check response length (some regulations require brevity)
        if len(response) > 1000:
            violations.append("Response exceeds maximum length")
        
        # 4. Check for required disclaimers
        if "medical" in prompt.lower() and "consult a healthcare professional" not in response:
            violations.append("Missing medical disclaimer")
        
        return {
            "compliant": len(violations) == 0,
            "violations": violations,
            "response_safe": self._sanitize_response(response) if violations else response
        }
    
    def _sanitize_response(self, response: str) -> str:
        """Remove or redact non-compliant content."""
        # Redact PII
        for pii_type, pattern in self.pii_patterns.items():
            response = re.sub(pattern, f"[REDACTED {pii_type.upper()}]", response)
        
        return response

# Usage
checker = ComplianceChecker()

prompt = "What are my symptoms mean?"
response = "Based on your symptoms, you might have condition X. Your SSN is 123-45-6789."

result = checker.check_compliance(prompt, response)
print(f"Compliant: {result['compliant']}")
print(f"Violations: {result['violations']}")
print(f"Sanitized response: {result['response_safe']}")
# Output:
# Compliant: False
# Violations: ['PII detected: ssn', 'Missing medical disclaimer']
# Sanitized response: "Based on your symptoms, you might have condition X. Your SSN is [REDACTED SSN]."

Common Misconceptions

Sources & Further Reading