What you'll learn: how to sort compliance questions in a customer review into facts you evidence, readings of the law that legal decides, and honest unknowns.
Not legal advice. It explains what an engineer typically supplies in a review. It does not say which law applies to any system or that any product complies. The customer's legal and compliance team decides. Law dates are as of 2026-11-03: open the linked source before you rely on one.
At a glance
Figure 1. Where each review question goes
How to read this: you answer facts, the customer's lawyers answer readings of the law, the rest is a named unknown.
- Facts you can show (data flow, subprocessors, retention, logs) are yours.
- Which law applies, which risk category and whose role: not yours.
- Never write "compliant" about your own system.
Scenario
Composite scenario, not a real company. Lumen Industrial Supply, a fictional distributor, is piloting the read-only Order and Policy Assistant for 24 customer-service agents. Its legal team sent a review sheet naming the EU AI Act, GDPR, SOC 2, HIPAA and ISO/IEC 42001, asking "Is the system compliant?"
What you will be able to do
- Say what you supply for five regimes.
- Sort questions into answer, route or unknown.
- Write a date-safe sentence about a law.
Prerequisites
Customer security and platform reviews: its field table is your evidence. Theory: Governance and responsible AI.
Core ideas
Five regimes, one split
| Regime | What it is (per its source) | Covers | You supply | Legal decides |
|---|---|---|---|---|
| EU AI Act, Regulation (EU) 2024/1689 | Rules for AI systems by risk | Providers, deployers, others (Art. 2) | Purpose, oversight description, log fields | Role, risk category, articles |
| GDPR, Regulation (EU) 2016/679 | Rules for processing personal data | Controllers and processors | Data flow, fields, subprocessors, retention, deletion path | Personal data or not, lawful basis, roles |
| SOC 2 (AICPA) | A CPA examination of a service organisation's controls | Service organisations | Providers you use; their reports | Whether a report is enough |
| HIPAA (US regulations, 45 CFR 160.103) | US rules that define protected health information | Covered entities and business associates | Data classes: any health information? | Whether it applies, any associate contract |
| ISO/IEC 42001 | A standard for an AI management system | Any organisation providing or using AI | Records: decisions, changes, evaluations | Whether to adopt it |
How to read this: the last two columns are the split.
What the texts say
The Commission's page describes four AI Act levels: banned practices, high-risk, transparency duties, and minimal risk. Article 6 and Annex III make listed areas high-risk (such as biometrics and employment), with a conditional exception in Article 6(3). Article 50(1) requires providers to design AI systems that interact directly with people so that they are told it is an AI system, unless obvious.
GDPR defines personal data as information relating to an identifiable person (Art. 4(1)). Articles 15 to 22 give rights including access, erasure and not being subject to a solely automated decision with significant effects. Article 28(2) bars a processor from engaging another processor without the controller's written authorisation.
Figure 2. The assistant's data flow as a reviewer will draw it
How to read this: each arrow is a hop a reviewer will ask about; mark where data leaves.
The questions the review will ask
| Question | Evidence you hand over | Owner |
|---|---|---|
| What data leaves our network, to whom? | Figure 2, field table, provider list with terms link and date | You |
| Is personal data sent to the model? | Field list of what it receives | You list; legal classifies |
| What do logs hold, for how long? | Log field list; retention setting | You; customer sets period |
| Can one person's data be found and deleted? | Map of every store (OMS, logs, provider), draft deletion path | You map; legal answers requests |
| Who can check or override an answer? | Read-only scope, cited sources, the agent decides | You |
| Do users know it is AI? | Screenshot of the label | You; legal decides if Art. 50 applies |
| Is it high-risk? | Purpose statement | Legal |
Decision exercise. A reviewer writes: "Confirm the assistant is not high-risk." Choose: (A) "Confirmed, it is read-only." (B) "Yes, high-risk, to be safe." (C) Send the purpose statement and oversight description; route the classification to legal.