AI governance regulation,
in plain language
Plain-language guides to every major AI governance regulation and framework relevant to MSPs operating in 2026, mapped to practical obligations.
Live obligations
EU AI Act
in forceRegulation (EU) 2024/1689. Risk-based classification of AI uses. Documentation requirements for high-risk applications. Human oversight obligations for decisions significantly affecting individuals. Applies to organizations using AI systems in EU markets, regardless of where the organization is based.
UK GDPR
in forceExisting data protection law extended in interpretation to AI processing. Submitting personal data to AI tools without lawful basis, appropriate safeguards, and respect for individual rights constitutes a breach. ICO has published explicit guidance on AI and data protection.
HIPAA AI Requirements
in forceHealthcare data processing by AI tools requires a Business Associate Agreement (BAA) with the vendor. No exceptions for widely-used tools. ChatGPT, Gemini, and Copilot all have BAA-eligible plans but consumer and default business plans do not include BAAs.
FCA AI Guidance
in forceExplainability, non-discrimination, human oversight, governance documentation. Regulated firms must manage AI use within their existing regulatory obligations.
Cyber Essentials Plus 2024 Update
in forceConfiguration drift now triggers instant certification failure (previously a warning). An SMB whose AI governance configuration has drifted outside its certified state is no longer compliant. Combined with ICO breach-reporting duties, this makes ungoverned AI data flows a certification and reporting issue for UK SMBs, not just a policy one.
The certification layer
ISO/IEC 42001
standardInternational standard for AI management systems. Provides the framework for organizational AI governance: policy, risk management, lifecycle, monitoring. Appearing in enterprise procurement questionnaires.
ISO/IEC 27001
standardInformation security management. Foundation that ISO 42001 extends. Often a prerequisite for enterprise sales in regulated verticals.
NIST AI Risk Management Framework
standardVoluntary framework. Govern, Map, Measure, Manage. Useful as an organizing structure for AI risk discussions.
SOC 2
standardTrust Services Criteria. Increasingly extended to cover AI use through additional control objectives.
Obligations arriving next
UK Cyber Security and Resilience Bill
progressingExpected to expand security obligations across essential services and supply chains. Will increase the audit and incident reporting expectations on MSPs and their clients.
EU AI Act Implementation Acts
progressingThe substantive obligations under the EU AI Act phase in over several years. Each phase brings additional requirements into force.
CIS companion guides
CIS Controls v8.1 AI and LLM Companion Guide
guidanceSafeguards for AI tool discovery, sanctioning, service provider management, and audit logging. Formal definition of Shadow AI. Explicit statement that using a public AI chat can constitute a data breach.
CIS Controls v8.1 AI Agents Companion Guide
guidanceShadow agent detection and DLP bypass risk. Agent stack allowlisting. Human-in-the-loop as a formal control requirement for high-risk agent tool invocations.
CIS Controls v8.1 MCP Companion Guide
guidanceSecurity controls for MCP hosts, clients, servers, and gateways. Six deployment security patterns. Real MCP CVEs mapped to controls.
CIS – An Introduction to AI: Security Concerns for SMEs
guidanceSME-facing baseline establishing the AI policy requirement.
How MSPs should approach this landscape
- 1
Identify your client base regulatory profile
Healthcare and financial services clients have immediate forcing functions. Commercial clients have growing exposure through procurement and insurance.
- 2
Establish your own posture first
An MSP cannot deliver a regulatory framework it has not implemented internally.
- 3
Maintain a BAA registry
For any healthcare clients. Default tool plans usually do not include a BAA.
- 4
Build configuration drift detection into your service
The Cyber Essentials Plus 2024 update made this load-bearing.
- 5
Track ISO 42001 and the EU AI Act phased obligations
Through the year. Quarterly review at minimum.
Map these obligations to your client base
The assessment scores compliance framework readiness as one of its six domains, including BAA registry and regulatory change monitoring.