Buying AI is buying regulated software. Four regimes account for most enterprise procurement gates, this is the plain-language read on what each binds, and what you should require before signing.
Regulation (EU) 2024/1689, the EU AI Act
The EU AI Act classifies AI systems by risk tier and sets binding obligations on deployers. Know what your use case requires before you procure.
Regulation (EU) 2016/679, the General Data Protection Regulation
GDPR requires a lawful basis for every AI processing operation, a signed data-processing agreement, and defined deletion paths. Here is what to verify.
Health Insurance Portability and Accountability Act of 1996 (HIPAA)
HIPAA requires a Business Associate Agreement before any protected health information enters an AI pipeline. Here is what to verify in a provider.
System and Organisation Controls 2 (SOC 2)
A SOC 2 Type II report covers a provider's operational controls, not the AI system itself. Know what it contains and what to ask for before signing.
ISO/IEC 42001:2023, Information technology — Artificial intelligence — Management system
ISO/IEC 42001 is the first international standard for AI management systems. Know what an accredited certification actually attests to before you rely on it.
NIST AI Risk Management Framework 1.0 (NIST AI 100-1) and Generative AI Profile (NIST AI 600-1)
The NIST AI RMF is voluntary but widely referenced in US federal and enterprise procurement. Here is what it asks of a provider and how to verify it.
Regulation (EU) 2022/2554, the Digital Operational Resilience Act (DORA)
DORA applies from January 2025 and reaches critical ICT third-party providers to EU financial entities. Here is what it means for AI procurement.
Regulatory compliance is a property of the deployed system, not the vendor. Trustgent's verification levels (how we verify) answer who has actually delivered what; the regime page answers what your use case binds you to. Together they form the procurement gate: use the regime brief to build the requirements list, then filter verified providers against it. Neither document is legal advice.