Identify what applies
Determine the applicable requirements for the system, jurisdiction and use case before deployment.
COMPLIANCE / EXPLAINEDFrom requirement
From requirement
to a decision you can explain.
A policy or framework sets expectations for an AI system. Compliance becomes reviewable when each relevant obligation is connected to a control, human decision and retained evidence.
Request a briefingHOW IT WORKS
What an evidence-based review needs.
Make the link between the obligation and a specific governed outcome visible to the people who must assess it.
01
Put the rule into operation
Map requirements to checks, escalation and meaningful human oversight at the point of use.
Retain what happened
Preserve the requirement, verdict, reviewer, timing and integrity proof needed to reconstruct the outcome.
AI MANAGEMENT SYSTEMManagement system above.
Management system above.
Operating controls below.
ISO/IEC 42001 establishes how an organisation manages AI. Nextvise supports the documentation review, Human in the Loop decisions and runtime controls needed to turn that management system into daily operation.
AIMS requirements→Documentation→Controls→Operation
FRAMEWORK REFERENCE / 29 ENTRIESWhat each framework means.
What each framework means.
What evidence can show.
A plain-language guide to the regulations, standards and guidance discussed across Nextvise. Applicability depends on the institution, use case and jurisdiction; technical records support a review, not automatic compliance or certification.
FRAMEWORKS / 07
Healthcare
HIPAAUS rules protecting identifiable health information.
What it addresses
Access, permitted uses, safeguards and accountability when protected health information is handled.
Evidence to review
Access decisions, data-handling controls and an attributable record of AI-supported use.
42 CFR Part 2US confidentiality protections for substance use disorder treatment records.
What it addresses
Special limits on disclosure, patient consent and the handling of covered records.
Evidence to review
Consent status and the reason, recipient and timing of a permitted disclosure.
EU AI Act · Articles 9, 12, 13, 14, 17EU requirements for high-risk AI systems, where the use case falls within scope.
What it addresses
Risk management, record-keeping, information for deployers, human oversight and quality management.
Evidence to review
The applicable control, output log, reviewer intervention and retained decision history.
GDPR · Articles 9, 17, 30, 32EU data-protection rules, including additional protections for special-category data.
What it addresses
Conditions for sensitive-data processing, erasure rights, processing records and security measures.
Evidence to review
Data-use decisions, access controls and records supporting privacy review; erasure must be assessed separately.
ISO/IEC 27001An international standard for an information security management system.
What it addresses
Risk treatment, documented security controls, monitoring and continual improvement.
Evidence to review
Controlled access, security events and change records that support an organisation’s assessment.
ISO/IEC 42001An international standard for an AI management system.
What it addresses
AI governance, impact assessment, roles, lifecycle controls and oversight.
Evidence to review
Traceable requirements, assurance findings, human reviews and operating records.
NIST AI RMFA voluntary US framework for managing AI risks.
What it addresses
Govern, Map, Measure and Manage across the AI lifecycle.
Evidence to review
Risk decisions connected to specific checks, outcomes and follow-up actions.
FRAMEWORKS / 06
Pharma & Life Sciences
21 CFR Part 11US FDA rules for electronic records and electronic signatures in covered activities.
What it addresses
Trustworthy records, controlled access, audit trails and signature controls where applicable.
Evidence to review
Attributable review, record integrity, version history and signature context.
GxP / GAMP 5Good-practice requirements and risk-based guidance for regulated life-sciences systems.
What it addresses
Intended use, validation, lifecycle management and documented controls.
Evidence to review
System context, validated workflow decisions, deviations and review history.
ALCOA+Data-integrity principles for records in regulated work.
What it addresses
Records should be attributable, legible, contemporaneous, original and accurate, as well as complete, consistent, enduring and available.
Evidence to review
Who made a decision, when, on what basis and how the record was preserved.
EU GMP Annex 11EU GMP expectations for computerised systems used in regulated manufacturing.
What it addresses
Validation, security, data integrity, audit trails and controlled operation.
Evidence to review
Traceable system events, review actions and exportable records within the validated process.
GVPEU good pharmacovigilance practices for monitoring medicine safety.
What it addresses
Documented signal and case handling, quality processes and accountable review.
Evidence to review
Source facts, classifications, escalation and the human decision for each relevant case.
FDA / EMA Good AI PracticeJoint 2026 guiding principles for AI used across the medicines lifecycle.
What it addresses
A human-centred, risk-based approach with appropriate data, evaluation and lifecycle oversight.
Evidence to review
Documented model context, evaluations, exceptions and qualified review of AI-supported outputs.
FRAMEWORKS / 06
Banking & Finance
Federal Reserve SR 26-2US interagency supervisory guidance on model risk management.
What it addresses
Governance, development, validation and ongoing monitoring proportionate to model risk.
Evidence to review
Model version, controls, validation findings and accountable decisions across the lifecycle.
ECOA / Regulation BUS fair-lending rules covering adverse credit decisions.
What it addresses
Specific and accurate reasons for an adverse action, even when a complex model is involved.
Evidence to review
The reasons, relevant inputs, control applied and review behind a credit outcome.
EU AI Act · Credit ScoringCreditworthiness assessment is a high-risk use case under the EU AI Act, subject to its scope and exceptions.
What it addresses
High-risk system obligations and, where applicable, deployer duties.
Evidence to review
Risk controls, logs, meaningful oversight and a reconstructable decision path.
GDPR · Article 22EU protections concerning solely automated decisions with legal or similarly significant effects.
What it addresses
Conditions for automated decision-making and applicable individual safeguards.
Evidence to review
Whether and how a qualified person could review or change the outcome.
DORAThe EU Digital Operational Resilience Act for financial entities.
What it addresses
ICT risk management, incident handling, resilience testing and third-party risk.
Evidence to review
Control operation and incident records showing what happened to an AI-supported workflow.
QCB & CBUAE AI GuidanceSupervisory expectations affecting AI use by licensed financial institutions in Qatar and the UAE.
What it addresses
Governance, customer impact, risk controls and data handling according to the applicable regulator.
Evidence to review
An attributable trail of controls, interventions and decisions kept within the required boundary.
FRAMEWORKS / 04
Federal · Defense · Sovereign
FedRAMPA US government programme for assessing and authorising cloud services.
What it addresses
Defined security baselines, independent assessment and continuous monitoring.
Evidence to review
Deployment boundaries, access events and operational control records; a product record is not a FedRAMP authorisation.
CMMCA US Defense Department programme for contractor cybersecurity assurance.
What it addresses
Protecting covered information with assessed practices at the applicable level.
Evidence to review
System-boundary and access records that can support an assessment; certification is separate.
SOC 2 Type 1 · BSI C5Different assurance approaches for service controls and cloud security.
What it addresses
Documented controls and independent assessment for the relevant service and scope.
Evidence to review
Technical control records can inform an audit but do not replace a SOC 2 report or C5 attestation.
FISMAUS federal legislation for information security programmes.
What it addresses
Risk-based security management and documented controls for federal information systems.
Evidence to review
Access, control and operational records retained within the authorised system boundary.
FRAMEWORKS / 06
GCC · Sovereign
UAE PDPLThe UAE federal personal data protection law.
What it addresses
Lawful processing, individual rights and safeguards, subject to applicable exclusions and sector rules.
Evidence to review
Processing decisions and data access within the deployment boundary.
ADHICS V2Abu Dhabi’s health-information and cybersecurity standard.
What it addresses
Security and governance for in-scope healthcare information systems.
Evidence to review
Protected data flows, access decisions and reviewable security events.
Saudi PDPL · NCA ECC · SAMA CSFSaudi privacy law and cybersecurity frameworks for covered entities and financial institutions.
What it addresses
Personal-data governance, essential cybersecurity controls and sector-specific security obligations.
Evidence to review
Local control operation, access and incident records, subject to the requirements that apply.
Qatar PDPPLQatar’s personal data privacy law.
What it addresses
Lawful handling of personal data, individual rights and appropriate protection.
Evidence to review
Attributable processing and control records maintained under the required jurisdiction.
Qatar NCSA AI GuidelinesNational cybersecurity guidance relevant to AI governance in Qatar.
What it addresses
Risk-aware AI use, security, accountability and human oversight in relevant settings.
Evidence to review
Documented risk decisions, oversight and technical controls for each governed use case.
Qatar National AI Strategy 2030Qatar’s national direction for AI adoption and responsible development.
What it addresses
Sector adoption, capability and responsible governance; it is not a certification scheme.
Evidence to review
Clear ownership, deployment boundaries and reviewable AI decision records.
CONTROL & EVIDENCE COVERAGEMapped to the requirements