Which Compliance Frameworks Shape AI Projects

We asked 33 regulated firms how compliance rules affected a specific AI project, and they named 13 compliance frameworks and a customer security check. The EU AI Act came up 17 times, and buyer-side security review ranked third with 8.

Study methodology: An open-response survey ran through Connectively and direct outreach between June and August 2026, and 33 of 67 submissions passed screening. 27 respondents operate in the United States and 10 in the European Union. Each respondent could name several frameworks, so the counts add up to more than 33.

Which Compliance Frameworks Shape AI Projects

Essential statistics: compliance frameworks that affected AI projects

• The EU AI Act drew 17 mentions from 33 respondents, more than any other rule in the study.
• FDA guidance on software as a medical device and its change control drew 9.
• Buyer-side security review, a questionnaire that customers run on their suppliers, drew 8.
• HIPAA and model risk management rules each drew 7 mentions.
• GDPR, SOC 2, bar and professional conduct rules, and IRS reporting rules each drew 3 to 4 mentions.
• DORA, NIS2, PCI-DSS, 42 CFR Part 2, and MHRA guidance drew 1 mention each.

Key takeaways

• 17 respondents named the EU AI Act, while only 10 operate in the EU. At least 7 of them named the law without an EU presence, so its reach extends past its own market.
• A check run by customers outranked most statutes. Buyer-side security review drew 8 mentions, against 7 for HIPAA and 4 for GDPR.
• Sector rules came up far more often than general privacy law. FDA guidance and HIPAA drew 16 mentions together, against 4 for GDPR.
• Even the most-cited framework reached only about half of the sample. The EU AI Act appeared in 17 of 33 responses, and every other rule appeared in fewer.
• The 5 frameworks, each mentioned once, apply within a single sector or jurisdiction. The full set of rules a team faces depends on where it sells and what data it handles.

Actionable insights

• Check where your buyers operate and where you do, since at least 7 respondents named the EU AI Act without an EU presence.
• Treat buyer security review as a release gate with its own evidence pack, since it drew 8 mentions, more than HIPAA at 7.
• Plan for the sector regulator ahead of the general privacy law, as FDA guidance and HIPAA together drew 4 times as many mentions as GDPR did.
• Build one evidence set that several compliance frameworks can reuse, because the average respondent named about 2 rules.
• Track the single-mention frameworks against your markets, since each one binds a narrow sector or region.

“The IRS requires 100% mathematical auditability on tax filings. Every lot ID must map back to a verified blockchain hash with zero variance. A model returning 99.2% accuracy meant 8 out of every 1,000 transactions contained subtle hallucinations on gain/loss figures. That created an immediate tax liability for our users.” — David Kemmerer, Co-founder and Chief Executive Officer, CoinLedger