# Regulations — CyberSentriq AI Governance ## AI governance regulation, _in plain language_ Plain-language guides to every major AI governance regulation and framework relevant to MSPs operating in 2026, mapped to practical obligations. In Force Today ### Live obligations #### EU AI Act in force EU + EU markets Regulation (EU) 2024/1689. Risk-based classification of AI uses. Documentation requirements for high-risk applications. Human oversight obligations for decisions significantly affecting individuals. Applies to organizations using AI systems in EU markets, regardless of where the organization is based. #### UK GDPR in force UK Existing data protection law extended in interpretation to AI processing. Submitting personal data to AI tools without lawful basis, appropriate safeguards, and respect for individual rights constitutes a breach. ICO has published explicit guidance on AI and data protection. #### HIPAA AI Requirements in force US Healthcare data processing by AI tools requires a Business Associate Agreement (BAA) with the vendor. No exceptions for widely-used tools. ChatGPT, Gemini, and Copilot all have BAA-eligible plans but consumer and default business plans do not include BAAs. #### FCA AI Guidance in force UK financial services Explainability, non-discrimination, human oversight, governance documentation. Regulated firms must manage AI use within their existing regulatory obligations. #### Cyber Essentials Plus 2024 Update in force UK Configuration drift now triggers instant certification failure (previously a warning). An SMB whose AI governance configuration has drifted outside its certified state is no longer compliant. Combined with ICO breach-reporting duties, this makes ungoverned AI data flows a certification and reporting issue for UK SMBs, not just a policy one. Standards and Frameworks ### The certification layer #### ISO/IEC 42001 standard Published 2023 · voluntary, increasingly required by procurement International standard for AI management systems. Provides the framework for organizational AI governance: policy, risk management, lifecycle, monitoring. Appearing in enterprise procurement questionnaires. #### ISO/IEC 27001 standard Active · widespread adoption Information security management. Foundation that ISO 42001 extends. Often a prerequisite for enterprise sales in regulated verticals. #### NIST AI Risk Management Framework standard US, increasingly international reference Voluntary framework. Govern, Map, Measure, Manage. Useful as an organizing structure for AI risk discussions. #### SOC 2 standard Active · widespread in tech and B2B Trust Services Criteria. Increasingly extended to cover AI use through additional control objectives. Progressing ### Obligations arriving next #### UK Cyber Security and Resilience Bill progressing UK · progressing through Parliament Expected to expand security obligations across essential services and supply chains. Will increase the audit and incident reporting expectations on MSPs and their clients. #### EU AI Act Implementation Acts progressing EU · phased through 2025–2026 The substantive obligations under the EU AI Act phase in over several years. Each phase brings additional requirements into force. Sector Guidance ### CIS companion guides #### CIS Controls v8.1 AI and LLM Companion Guide guidance Published April 2026 · CIS Safeguards for AI tool discovery, sanctioning, service provider management, and audit logging. Formal definition of Shadow AI. Explicit statement that using a public AI chat can constitute a data breach. #### CIS Controls v8.1 AI Agents Companion Guide guidance Published April 2026 · CIS Shadow agent detection and DLP bypass risk. Agent stack allowlisting. Human-in-the-loop as a formal control requirement for high-risk agent tool invocations. #### CIS Controls v8.1 MCP Companion Guide guidance Published April 2026 · CIS Security controls for MCP hosts, clients, servers, and gateways. Six deployment security patterns. Real MCP CVEs mapped to controls. #### CIS – An Introduction to AI: Security Concerns for SMEs guidance Published August 2025 · CIS SME-facing baseline establishing the AI policy requirement. Putting it to work ### How MSPs should approach this landscape - 1 #### Identify your client base regulatory profile Healthcare and financial services clients have immediate forcing functions. Commercial clients have growing exposure through procurement and insurance. - 2 #### Establish your own posture first An MSP cannot deliver a regulatory framework it has not implemented internally. - 3 #### Maintain a BAA registry For any healthcare clients. Default tool plans usually do not include a BAA. - 4 #### Build configuration drift detection into your service The Cyber Essentials Plus 2024 update made this load-bearing. - 5 #### Track ISO 42001 and the EU AI Act phased obligations Through the year. Quarterly review at minimum. ### Map these obligations to your client base The assessment scores compliance framework readiness as one of its six domains, including BAA registry and regulatory change monitoring. [Take the assessment](/assessment)