The Regulatory Atlas

The EU's comprehensive personal-data law. It governs how any organization collects, uses, stores, and shares personal data about people in the EU/EEA — and it applies even if your company sits outside Europe, as long as you handle Europeans' data (extraterritorial reach).

Anyone processing EU residents' personal data. It splits roles into the controller (decides why/how data is used) and the processor (handles it on the controller's behalf). Larger operations must appoint a Data Protection Officer (DPO).

• A lawful basis for every use of data (consent, contract, legal obligation, legitimate interests, etc.).
• Core principles: purpose limitation, data minimization, accuracy, storage limitation, security, accountability.
• Data-subject rights: access, correction, erasure (“right to be forgotten”), portability, objection, and a right not to be subject to solely automated decisions (Art. 22).
• Breach notification to the regulator within 72 hours; a DPIA for high-risk processing.

Fines up to €20 million or 4% of global annual turnover, whichever is higher.

A US federal law passed after the Enron and WorldCom accounting scandals. Its aim: make corporate financial statements trustworthy by forcing strong internal controls and holding executives personally accountable for them.

US publicly traded companies (and foreign firms listed on US exchanges), plus their auditors. It created the PCAOB to oversee those auditors.

• Section 302: the CEO and CFO personally certify each financial report is accurate.
• Section 404: management and the external auditor must assess and attest to Internal Control over Financial Reporting (ICFR) — the famous, expensive one.
• Section 802: records-retention and anti-document-shredding rules.
• Whistleblower protections; independent audit committees.

Criminal: executives face fines and up to 20 years' imprisonment for willful false certification or fraud.

The US law protecting Protected Health Information (PHI) — medical records and any health data that can identify a person. It sets national standards for keeping that information private and secure.

Covered entities — health providers, health plans, and clearinghouses — and their business associates (vendors that touch PHI, e.g. a cloud host or a billing firm).

• Privacy Rule: limits use/disclosure of PHI to the “minimum necessary.”
• Security Rule: administrative, physical, and technical safeguards for electronic PHI (access controls, encryption, audit logs).
• Breach Notification Rule: notify affected individuals (and, for large breaches, the media and regulator).

Tiered civil penalties (up to ~$1.9M per violation category per year) and criminal penalties up to 10 years' imprisonment for knowing misuse.

The world's leading standard for an Information Security Management System (ISMS) — a documented, risk-based way of running security across the whole organization. Not a law: you get certified against it by an accredited auditor.

Any organization, voluntarily — but very often required by customers as a condition of doing business, especially in B2B and cloud.

• A working ISMS built on risk assessment and treatment.
• Consideration of 93 controls in Annex A, grouped into four themes: Organizational, People, Physical, Technological.
• Continual improvement (the Plan-Do-Check-Act cycle) and management review.

No government fine — but you can fail or lose certification (via 3-year cycles with annual surveillance audits), which can cost you contracts.

A security standard for anyone who stores, processes, or transmits credit-card data. It's set not by a government but by the card brands' council (the PCI SSC — Visa, Mastercard, Amex, etc.) and enforced through your contracts with banks and processors.

Every merchant and service provider that handles cardholder data — from a corner shop to a global platform. Your transaction volume sets your validation level (a simple self-questionnaire vs. a full on-site audit).

12 requirements across 6 goals: build/maintain a secure network, protect stored cardholder data (encryption), manage vulnerabilities, enforce strong access control (incl. MFA), monitor and test networks, and maintain a security policy.

Contractual fines from card brands, higher transaction fees, and — the real killer — losing your ability to accept card payments.

A voluntary, outcome-based framework from the US National Institute of Standards and Technology for organizing an entire cybersecurity program into a shared language. Not a checklist of controls — a map of outcomes to aim for.

Originally for US critical infrastructure; now used worldwide, across every sector, because it's flexible and free.

Nothing mandatory — you self-adopt. It's built on six core functions (v2.0 added the first): Govern, Identify, Protect, Detect, Respond, Recover. Organizations rate their maturity in Tiers (1–4) and set target Profiles.

None directly — but it's the de-facto benchmark regulators and courts point to when asking “was your security reasonable?”

California's landmark privacy law — the US's closest answer to GDPR — later strengthened by the CPRA amendment. It gives California residents control over the personal information businesses collect about them.

For-profit businesses that handle Californians' data and meet a threshold (e.g. ~$25M+ revenue, or data on 100k+ consumers, or majority of revenue from selling data). Enforced by a dedicated agency, the CPPA.

• Consumer rights to know, delete, correct, and opt out of the sale/sharing of their data.
• A right to limit use of sensitive personal information.
• Non-discrimination for exercising these rights.

Civil penalties of $2,500 per violation, rising to $7,500 for intentional violations or those involving minors — multiplied across thousands of consumers.

The world's first comprehensive AI law. It regulates AI by risk tier: the more potential for harm, the heavier the obligations — from an outright ban down to no rules at all.

Providers (who build/place AI on the market) and deployers (who use it), anywhere in the world, if the AI's output is used in the EU. Extraterritorial, like GDPR.

• Unacceptable risk → banned (social scoring, manipulative AI).
• High risk (Annex III: credit, hiring, biometrics…) → full regime: risk management, data governance, human oversight, technical documentation, conformity assessment, and EU registration.
• Limited risk (chatbots, deepfakes) → transparency only.
• Minimal risk → no obligations. Separate rules cover general-purpose AI models.

Up to €35M or 7% of global turnover (banned uses); €15M or 3% (most obligations); €7.5M or 1% (misinformation to regulators). High-risk duties apply from August 2026.

The discipline of keeping AI compliant over its whole lifecycle — not just at launch. Where the AI Act says what you must achieve, AICM is the how: the standing processes that make compliance repeatable and durable.

Any organization operating AI systems it must keep compliant as models, data, and laws all change over time.

• Risk classification of every system before build.
• Standing conformity-assessment and documentation processes (not one-offs).
• Post-market monitoring for drift and incidents.
• Lifecycle tracking from development through decommissioning.

The ethics layer above the law. Where the AI Act sets the legal floor, AIEU raises the bar to what is legitimate and trustworthy — the practices that keep public trust even where the law is silent.

Anyone building AI that affects people, especially in high-stakes settings where “legal” isn't the same as “acceptable.”

• Transparency & explainability — people can understand a decision.
• Fairness & non-discrimination; human oversight & autonomy.
• Accountability, robustness & safety, and protection of fundamental rights.