%201.svg)
HIPAA Compliance Checklist for 2025
Your compliance team has three AI regulation deadlines on a spreadsheet somewhere. Nobody's fully sure which ones are still live, which got pushed back, and which one just quietly became enforceable this month.
Here's what's actually true right now: the EU AI Act's transparency rules went live on August 2, 2026. Texas has been enforcing TRAIGA since January. Colorado repealed its own AI Act and replaced it with something narrower that doesn't start until 2027.
This article sorts what's actually enforceable today from what got delayed, and what a defensible AI governance regulations program needs to produce when a regulator asks for evidence.
TL;DR
What every enterprise needs to know about AI governance regulations right now:
- EU Article 50 transparency rules, Texas TRAIGA, and California's SB 53 are live now. EU high-risk obligations and Colorado's law were pushed back, but the underlying obligations still stand.
- "We don't run high-risk AI" no longer means "we're exempt." Disclosure duties apply regardless of risk tier.
- Most compliance teams can't produce one answer to "are we compliant," because no single system tracks SaaS-connected AI, personal AI logins, and embedded AI features together.
- A defensible answer needs a living inventory, usage attribution, and enforcement evidence, not a vendor list.
- No federal law preempts state AI regulation, and 145 state AI laws were enacted in 2025 alone. Enforcement sits with state AGs, not Washington.
- NIST AI RMF still reduces documentation burden across jurisdictions, though Colorado quietly dropped the legal safe harbor it once tied to it.
1. Which AI Regulations Are Actually Live Right Now?
EU Article 50 transparency rules, Texas TRAIGA, and California's SB 53 and AB 2013 are enforceable today. EU high-risk obligations and Colorado's original AI Act are not, they were pushed to 2027 and 2028.
Most of the current AI governance regulations confusion comes down to one habit: treating a delayed obligation as a cancelled one, then relaxing on the parts, including shadow AI disclosure, that are still enforceable today.
2. Does Not Having High-Risk AI Systems Actually Protect You?
No, and this is where most enterprises are exposed without realizing it.
The Digital Omnibus only delayed Annex III and Annex I high-risk obligations. Everything else on the EU AI Act's calendar held its original date. GPAI obligations under Articles 51 to 55 have applied since August 2025. Article 4's AI literacy duty has applied since February 2025. And Article 50 transparency – disclosure whenever someone is interacting with AI or viewing AI-generated content – is live today, independent of how your systems get classified.
So if your organization uses generative AI that produces content employees or customers see, disclosure obligations already apply to you.
High-risk classification only ever covered one slice of the AI Act, and treating it as the whole of your AI governance regulations exposure is how enterprises end up non-compliant without realizing it.
Read our breakdown of the EU AI Act and SaaS governance if you need the full deployer obligation set beyond transparency.
3. Can You Prove You're Compliant, and What Would You Actually Hand a Regulator?
No, not with what most compliance teams have today. Ask your compliance lead for one view of every AI tool in use, its classification, and its current status, and that view doesn't exist. It splits across three separate blind spots.
You don't have one inventory; you have three people checking separately
Someone checks Copilot's settings. Someone else checks the AI add-ons inside Salesforce. A third person emails IT about ChatGPT Enterprise seats. Nobody checks the AI features quietly embedded inside tools approved for something else entirely, and none of these checks roll up into a single answer.
Employees are already routing around your sanctioned tools
This is the pattern across most enterprises we talk to: a team gets denied a license, or the approved tool is slower than what they're used to, so someone pays for ChatGPT Plus or Gemini Advanced personally and uses it for work anyway.
No procurement record. No data processing agreement. No audit trail. Under EU transparency rules and TRAIGA's disclosure requirements, the obligation still sits with the organization, whether or not the tool was ever sanctioned.
The governance tool you already bought can't see it either
Most AI governance platforms operate at the SaaS layer. They see what connects through SSO and what shows up on a corporate card. They don't see:
- The browser extension an employee installed locally
- A personal AI account used from a company laptop, outside SSO entirely
- Agentic workflows spun up through a local MCP connection that never touches the SaaS stack
"We bought a tool for this" gets treated internally as "we're covered." It rarely survives an actual audit, and closing that gap is most of what an AI governance regulations program does day to day. Our piece on agentic AI governance covers what visibility past the SaaS layer actually requires.
So what would satisfy a regulator tomorrow?
A spreadsheet of vendor names won't satisfy that ask. A defensible answer needs three things:
- A living inventory: Every AI tool in use, its purpose, the data it touches, and who owns it, updated continuously rather than refreshed once a year.
- Usage attribution: Which teams and individuals are actually using each tool, not just who holds a license.
- Enforcement evidence: Documented proof that unsanctioned tools were caught and addressed, not just a policy stating they shouldn't exist.
A vendor list answers "what did we buy." Current AI governance regulations are asking "what's actually running, and who's accountable for it." Our AI compliance checklist maps this against SOC 2, GDPR, and EU AI Act requirements side by side.
4. Should You Wait for Federal Law to Settle This?
There's no sign it's coming, so no.
A proposed ten-year moratorium on state AI laws was stripped from federal legislation by a 99-to-1 Senate vote. A separate preemption attempt through defense authorization legislation also failed. Meanwhile, states kept legislating anyway. 145 AI-related laws were enacted in 2025 alone, across all 50 states, and 2026's pace is already ahead of it.
Enforcement authority sits with state attorneys general today, not with any federal agency:
- Colorado's AG, for SB 26-189 starting 2027
- Texas's AG, actively enforcing TRAIGA now
- California's Civil Rights Department, for employment-related AI use
A multistate enterprise faces five or more overlapping obligation sets right now, with no single federal standard to design around instead.
Your AI governance regulations exposure is set state by state, and waiting for Washington to settle this leaves you exposed to whichever AG moves first, and several already have.
One framework move still helps regardless of which state you're in. Colorado's original AI Act offered a rebuttable presumption of reasonable care to organizations aligned with NIST AI RMF, but that specific safe harbor is gone. Colorado repealed SB 24-205 and replaced it with SB 26-189, which dropped the rebuttable-presumption language entirely.
NIST AI RMF still overlaps heavily with EU AI Act risk management and SOC 2 evidence, so adopting it once still cuts the documentation burden your AI governance regulations program carries across jurisdictions. It's just infrastructure now, rather than a legal shield.
5. What Would It Take to Actually Close This Gap?
Every regulation covered here, live or delayed, state or EU, is really asking the same thing: prove you know every AI system running in your organization, who's using it, and what happens when someone doesn't follow the rules.
NIST AI RMF gives you the documentation structure for that answer. It doesn't give you the underlying visibility the documentation is supposed to describe.
That's a SaaS and identity governance problem before it's a compliance one, which is exactly the layer CloudEagle.ai already operates at for enterprise IT, security, and finance teams building out an AI governance regulations program. Here's where that visibility actually closes the three gaps this article has walked through.
a) You can't produce a single view of every AI tool in use, because no one system currently tracks SaaS-connected AI, personal AI logins, and embedded AI features together:
That's the inventory problem an AI governance regulations program runs into first, and it's the first thing an auditor or regulator will test.
How CloudEagle.ai solves it:
- Continuously discovers AI tools across SSO, browser activity, spend data, and identity signals, including personal accounts used on company devices
- Correlates usage against license, spend, and access data to flag tools that regulators would classify as shadow AI
- Feeds every discovered tool into one always-current inventory instead of a point-in-time audit snapshot
Compliance teams stop reconstructing their AI footprint from memory before every audit.
b) A written AI policy proves intent, not enforcement, and enforcement is what examiners actually probe:
Most teams can point to a policy document. Few can produce a log showing what happened the last time someone broke it.
How CloudEagle.ai solves it:
- Maps every discovered AI tool to the frameworks it touches, SOC 2, GDPR, HIPAA, and the EU AI Act, in one control library
- Logs access decisions and policy actions automatically instead of relying on manual tracking
- Intercepts unsanctioned AI tool access at the point of use, rather than catching it in a review months later
ICEYE's IT and security team used this shift to move from uncertain, manually compiled access certifications to structured review cycles, cutting manual access review work by 90% and saving over 1,500 hours a year.
c) Every AI agent and integration is a new non-human identity, and most compliance programs still track it as a footnote instead of an audit line item:
Agent identities accumulate permissions the same way employee accounts do, just without anyone running the same review cadence on them.
How CloudEagle.ai solves it:
- Discovers and inventories non-human identities tied to AI agents and MCP-connected workflows alongside human identities
- Applies the same ownership and least-privilege enforcement to AI agent access as to employee access
- Surfaces orphaned or over-permissioned agent identities before they become the finding in your next audit
Read more on the non-human identity debt most enterprises are quietly accumulating right now.
None of this replaces legal review of what applies to your specific footprint, but it does mean you walk into that review with an actual inventory instead of a guess.
Your AI Inventory Has Gaps Regulators Will Find First.
6. FAQs
1. What AI governance regulations are already enforceable in 2026?
EU AI Act Article 50 transparency rules, Texas TRAIGA, and California's SB 53 and AB 2013 are all live and enforceable now.
2. Does the EU AI Act delay mean enterprises can wait until 2027?
No. Only high-risk Annex III and Annex I obligations were delayed. Transparency and GPAI duties remain enforceable today.
3. Is there a federal law that overrides state AI regulations?
No enacted federal law preempts state AI regulation. A proposed moratorium failed 99 to 1 in the Senate in 2025.
4. Does following NIST AI RMF still protect us legally?
It strengthens documentation for your AI governance regulations program, but Colorado removed the specific statutory safe harbor once tied to the framework.
5. What counts as an AI system under current AI governance regulations?
Any tool that processes data to generate content, predictions, or decisions, including AI features embedded inside already-approved software.
See what your current AI governance regulations inventory is actually missing: book time with CloudEagle.ai.
Stop Guessing What Regulators Will Ask For
.avif)
.avif)
.avif)
.png)
.avif)
.avif)
.avif)
