Regulatory Compliance and Documentation

Regulatory compliance for agentic AI is not a domain that can be delegated to a compliance team in isolation. It requires engineers who understand documentation requirements well enough to build systems that generate compliant artifacts automatically, legal counsel who understand enough about how agents work to identify risk, and business leaders who can make tradeoff decisions when compliance requirements constrain agent capability. This cross-functional integration is the foundation of a durable compliance program.

The Regulatory Landscape in 2025

Enterprise AI practitioners must navigate a rapidly expanding set of regulatory requirements:

EU AI Act: The most comprehensive AI regulatory framework globally, with a risk-based classification system and mandatory requirements for high-risk AI systems. GPAI provider obligations—including transparency reporting, copyright compliance documentation, and systemic risk assessment for frontier models—take effect August 2025. High-risk AI system requirements under Annex III, covering conformity assessments, technical documentation, human oversight measures, and registration in the EU AI Act database, apply from August 2026. Organizations with AI deployments that affect EU-based individuals must assess their obligations regardless of where the organization is headquartered.

Sector-specific AI regulations: Financial services regulators (OCC, FRB, FFIEC in the US; EBA and ESMA in the EU) have issued supervisory guidance on AI model risk management that extends and applies to agentic systems. Healthcare AI is subject to FDA oversight for software as a medical device, OCR enforcement of HIPAA automated decision-making provisions, and emerging CMS requirements for AI in coverage determinations. Employment AI faces scrutiny from the EEOC under Title VII disparate impact doctrine and local AI hiring laws (New York City Local Law 144, Illinois AIEA).

Data protection regulations: GDPR Article 22 provides rights to individuals subject to solely automated decisions with significant effects, including the right to human review. This provision applies directly to any agentic system that makes consequential decisions about EU residents. CCPA and its CPRA amendments create equivalent opt-out rights in California. Adequately implementing these rights requires that agents can generate human-reviewable decision records on request.

Emerging AI liability frameworks: The EU AI Liability Directive, once enacted, will create rebuttable presumption of causality between AI system defects and damages, placing the burden on deploying organizations to demonstrate that their systems complied with applicable requirements.

ISO/IEC 42001: The Certifiable Standard

ISO/IEC 42001:2023 provides the framework for a certifiable AI Management System (AIMS). Unlike the EU AI Act, which is a regulatory requirement, ISO/IEC 42001 is a voluntary standard—but certification against it is increasingly demanded by enterprise customers, investors, and regulators as evidence of governance maturity. The standard requires:

  • Clause 4: Understanding the organization and its context, including interested parties (regulators, customers, affected individuals) and their requirements
  • Clause 6: AI risk assessment and treatment planning, including documented AI objectives and measures to achieve them
  • Clause 8: AI system impact assessment and lifecycle management, including documentation of training data, model characteristics, and validation results
  • Clause 9: Performance evaluation through internal audits and management reviews
  • Clause 10: Continual improvement through corrective action on nonconformities

Certification requires a third-party audit by an accredited certification body. Organizations should begin with a gap assessment against the standard’s requirements, develop an implementation roadmap, and target initial certification within 12-18 months of program launch.

Technical Documentation Requirements

For EU AI Act high-risk systems and as general governance best practice, maintain a Technical Documentation Package for each agent deployment. This package must be maintained throughout the agent’s operational life and updated when material changes occur. Core components include:

System description: Agent name, version, deployment date, responsible organization, intended purpose, and the EU AI Act risk classification with supporting rationale.

Model and system architecture: Description of the AI model(s) used, training data sources and provenance where applicable, model provider and any fine-tuning applied, context window management approach, and tool integration architecture.

Capability and limitation statement: A frank description of what the agent does well, what it does poorly, and the conditions under which it may fail. This includes known edge cases, performance limitations on specific task types, and out-of-scope scenarios.

Validation and testing records: Results of pre-deployment evaluation including benchmark datasets used, accuracy metrics by task category, bias testing results, adversarial robustness testing (prompt injection resistance), and human evaluation results where conducted.

Human oversight measures: Documentation of the HITL and HOTL patterns implemented, the specific checkpoints where human approval is required, the oversight roles responsible for each checkpoint, and how the LangGraph interrupt() mechanism is configured.

Data governance documentation: Data flows showing what user data the agent accesses and processes, data retention policies, data subject rights implementation (access, deletion, correction), and cross-border data transfer mechanisms.

Change management log: Record of all material changes to the agent’s system prompt, model version, tool configuration, or authorization scope, with the date, rationale, and pre/post-change testing results.

Audit Readiness

Regulatory audits and customer due diligence reviews are inevitable for organizations deploying consequential AI systems. Maintain audit readiness as an ongoing operational state rather than a periodic scramble. This means:

  • All technical documentation is current and version-controlled
  • Training records for AI Operations personnel are maintained in an accessible HR system
  • Incident logs are complete and include corrective action evidence
  • Access control configurations are documented and match the technical documentation
  • HITL approval logs include reviewer identity and decision rationale

Designate an AI Compliance Lead with responsibility for maintaining audit readiness, coordinating regulatory inquiries, and tracking the evolving regulatory landscape. This role should participate in industry working groups (the Partnership on AI, BSA|The Software Alliance AI Working Group, sector-specific bodies) to stay current on emerging requirements.

Third-party audits—whether for ISO/IEC 42001 certification or regulatory compliance verification—should be preceded by an internal pre-audit assessment that tests your documentation against the applicable requirements. Engage an auditor-familiar consultant to conduct the pre-audit if your team lacks experience with the audit process.

Make It Your Own

Key questions to ask in the context of your organization:

  • Have you assessed every agent deployment against the EU AI Act’s Annex III high-risk classification criteria, and for those that qualify, have you initiated the conformity assessment and technical documentation process with a realistic timeline to meet the August 2026 deadline?
  • Do you have a Technical Documentation Package for each agent in production that includes the system description, model architecture, capability/limitation statement, validation records, human oversight configuration, and change management log—maintained as a living document?
  • Have you implemented the data subject rights required by GDPR Article 22 and CCPA for agents that make automated decisions about individuals—specifically the ability to provide a human-reviewable decision record on request?
  • Have you designated an AI Compliance Lead with responsibility for regulatory tracking, audit readiness maintenance, and coordination of regulatory inquiries, with access to cross-functional support from legal, engineering, and operations?
  • Is your organization on a credible path to ISO/IEC 42001 certification—have you completed a gap assessment, built an implementation roadmap, and engaged an accredited certification body for a target audit date?
  • When your agents undergo material changes (model update, prompt change, scope expansion, tool addition), is there a documented change review process that updates technical documentation, re-runs relevant validation tests, and reassesses compliance obligations before the change reaches production?