Tracking AI Regulations and Industry Standards

Overview
Tracking AI regulations and industry standards is a core task in the PMI Certified Professional in Managing AI (PMI-CPMAI) domain Support Responsible and Trustworthy AI Efforts. It means watching the changing legal, regulatory and standards landscape on an ongoing basis. You check how each change applies to your AI project, and you build what you learn into the project lifecycle. The goal is that AI solutions stay compliant, ethical and trustworthy from conception through operation.

Why It Is Important
1. Rapidly evolving landscape: AI law is changing fast. Examples include:
- the EU AI Act
- US executive orders and state laws such as the Colorado AI Act and NYC Local Law 144 on automated hiring tools
- China's generative AI measures
- Canada's proposed AIDA
- sector rules in finance, healthcare and employment
A project that was compliant at kickoff may not be compliant at deployment.
2. Risk mitigation: Non-compliance can bring heavy fines (the EU AI Act allows fines up to 7% of global annual turnover for prohibited practices). It can also bring lawsuits, forced product withdrawal and reputational damage.
3. Avoiding rework: Finding a regulatory requirement late can force you to redesign the solution, retrain the model, collect new data or abandon the project. Tracking early is cheaper.
4. Stakeholder trust: Customers, regulators, auditors and the public expect AI to be transparent, fair, explainable and accountable.
5. Market access and competitive advantage: Aligning with recognized standards such as ISO/IEC 42001 can be required for contracts, procurement or entry into certain markets.
6. Data dependency: AI depends heavily on data. Privacy laws therefore directly shape what data you can use and how you can use it. Examples are GDPR, CCPA/CPRA, HIPAA, and copyright and IP rules.

What It Is
It is the systematic practice of identifying, monitoring, interpreting and applying external rules and frameworks to AI projects. These rules come in several categories:

1. Binding regulations (hard law):
- EU AI Act: a risk-based approach with four tiers. Unacceptable-risk uses are prohibited. High-risk uses carry strict obligations such as conformity assessment, risk management, data governance, human oversight and logging. Limited-risk uses carry transparency duties. Minimal-risk uses face few obligations.
- Data protection laws: GDPR (including Article 22 on automated decision-making), CCPA/CPRA, PIPEDA, LGPD.
- Sector-specific rules: FDA guidance for AI/ML medical devices, financial model risk management (e.g., SR 11-7), fair lending laws (ECOA), and employment anti-discrimination laws.
- Local and state laws: e.g., bias audits for automated employment decision tools.

2. Voluntary frameworks and standards (soft law):
- NIST AI Risk Management Framework (AI RMF 1.0): four functions, Govern, Map, Measure and Manage. It also has a Generative AI Profile.
- ISO/IEC 42001: AI management system standard, which is certifiable.
- ISO/IEC 23894: guidance on AI risk management.
- ISO/IEC 22989 and 23053: AI concepts, terminology and framework.
- IEEE 7000 series: ethically aligned design.
- OECD AI Principles and the UNESCO Recommendation on the Ethics of AI.
- Industry codes of conduct and the organization's own internal AI policies.

3. Organizational policies: Internal AI ethics guidelines, acceptable use policies and governance board requirements. These often turn external rules into concrete controls.

How It Works (The Process)
Step 1: Establish ownership and governance. Assign clear responsibility, such as a compliance lead, legal counsel, an AI ethics board or a Responsible AI office. The AI project manager does not need to be a lawyer. The PM is responsible for making sure the right experts are engaged and that requirements are incorporated.

Step 2: Identify applicable jurisdictions and domains. Determine:
- where the system will be developed, deployed and used
- whose data it processes
- which industry it serves
- what decisions it influences
Regulations often apply based on where users or affected people are located, not just where the company is.

Step 3: Classify the AI use case by risk. Use frameworks such as the EU AI Act tiers or internal risk matrices. High-risk uses include credit scoring, hiring, healthcare, critical infrastructure, law enforcement and education. Higher risk means more obligations.

Step 4: Build a regulatory and standards register. Keep a living document that lists:
- each applicable law or standard
- its specific requirements
- the owner
- compliance status
- evidence
- review dates

Step 5: Set up monitoring mechanisms.
- Subscribe to regulator updates.
- Use legal and compliance newsletters and regulatory intelligence tools.
- Join industry associations and standards bodies.
- Attend briefings.
- Schedule periodic reviews at phase gates.

Step 6: Translate requirements into project artifacts. Convert legal obligations into:
- functional and non-functional requirements
- data governance controls
- documentation such as model cards, datasheets, impact assessments and DPIAs
- testing criteria for bias, robustness and explainability
- human-in-the-loop designs
- acceptance criteria

Step 7: Integrate into the AI lifecycle. In CPMAI, which follows a CRISP-DM-based iterative methodology, compliance checks belong in every phase:
- Business Understanding: identify legal constraints and go/no-go factors.
- Data Understanding and Preparation: check consent, provenance, privacy and bias in the data.
- Model Development: address explainability and fairness constraints.
- Model Evaluation: run compliance testing and audits.
- Operationalization: set up monitoring, logging, incident reporting and post-market surveillance.

Step 8: Assess impact of changes. When a new rule or amendment appears, do an impact analysis covering scope, schedule, cost, risk and design. Then route it through change control.

Step 9: Communicate and train. Inform stakeholders, train the team on new obligations, and update the communication plan.

Step 10: Document and audit. Keep traceability from each requirement to the control and the evidence behind it. This audit trail shows due diligence to regulators.

Step 11: Continuously monitor post-deployment. AI systems drift, and regulations change. Compliance is never one-and-done. Re-evaluate periodically and whenever the model, data or use case changes.

Key Concepts to Remember
- Risk-based approach: obligations grow with the potential for harm.
- Extraterritoriality: laws like GDPR and the EU AI Act can apply outside their home region.
- Hard law vs. soft law: regulations are mandatory, while standards are usually voluntary. Standards can become de facto mandatory through contracts, or serve as evidence of compliance (e.g., harmonized standards under the EU AI Act).
- Trustworthy AI pillars: fairness, transparency, explainability, accountability, privacy, safety, security, robustness and human oversight.
- Living process: tracking is continuous, iterative and built into governance.
- Cross-functional collaboration: legal, compliance, privacy, security, data science, business owners and ethics boards all take part.

Exam Tips: Answering Questions on Tracking AI Regulations and Industry Standards
1. Choose proactive over reactive. The best answer usually identifies and addresses regulatory requirements early, in the Business Understanding phase. Waiting until deployment or reacting after an audit finding is rarely right.
2. Consult experts; do not self-interpret law. When a scenario raises an unclear regulatory question, the PM should engage legal, compliance or privacy specialists. The PM should not make legal judgments alone or ignore the issue.
3. Continuous, not one-time. Prefer answers that set up ongoing monitoring, periodic reviews and post-deployment surveillance. Be wary of answers that treat compliance as a one-time checklist.
4. Assess before acting. When a new regulation is announced mid-project, the first step is usually to analyze its impact on the project. Do not halt everything immediately or ignore it. Then use change control and inform stakeholders.
5. Risk-based thinking. Watch for high-risk domains such as hiring, lending, healthcare, biometrics and children. These call for stricter controls, impact assessments, human oversight and documentation.
6. Data first. AI projects are data-centric. Many questions hinge on data privacy, consent, data provenance or data residency. Confirm you have the right to use the data before building models.
7. Documentation and traceability win. Answers involving a compliance register, model cards, impact assessments, audit trails or requirement traceability are often correct.
8. Know the major frameworks by name and purpose.
- NIST AI RMF: Govern, Map, Measure, Manage.
- ISO/IEC 42001: AI management system.
- EU AI Act: risk tiers.
- GDPR: data protection and automated decisions.
- OECD principles: high-level values.
9. Most stringent applicable requirement. When a system operates across several jurisdictions, the sound approach is often to design to the strictest applicable requirement, or to configure the system by region.
10. Stakeholder communication. Regulatory changes affect scope and risk. The correct answer often includes updating the risk register and informing the sponsor and governance bodies.
11. Ethics beyond legality. CPMAI stresses that legal compliance is the minimum. Trustworthy AI may require going beyond the law to meet ethical and organizational standards.
12. Eliminate extreme answers. Rule out options that ignore regulations, cancel projects without analysis, deploy first and fix later, or give compliance entirely to the data science team.
13. Watch for keywords. Words like first, best, most appropriate, next signal sequencing. Usually the order is: identify, then assess or analyze, then consult, then plan, then implement, then monitor.

Sample Question
A PM is leading an AI resume-screening project for a global company. Midway through, a new regional law requiring annual bias audits for automated hiring tools is enacted. What should the PM do FIRST?
A) Stop the project immediately.
B) Continue as planned since the law was enacted after kickoff.
C) Work with legal/compliance to assess the law's impact on the project and update the risk register and plan accordingly.
D) Ask the data scientists to remove demographic features.
Answer: C. It follows the pattern of assessing impact, consulting experts and integrating through governance. A overreacts, B ignores the law, and D is a premature technical fix that may not even ensure fairness.

Summary
Tracking AI regulations and industry standards is a continuous, cross-functional and risk-based activity. It makes sure AI projects stay legal, ethical and trustworthy. For the exam, favor answers that are:
- proactive
- expert-informed
- documented
- integrated across the lifecycle
- continuously monitored