Which AI regulations apply to you?

Answer five quick questions and see the AI rules and frameworks your institution should be mapping to — with the EU AI Act risk tier called out. Takes about a minute.

1 · Institution type

2 · Where you operate

3 · Public company (SEC-reporting)?

Yes No

4 · AI use cases (check all that apply)

Credit / underwriting decisions Financial / regulatory reporting Customer-facing (chat / recommendations) Fraud / AML None yet

5 · Data involved (check all that apply)

Consumer PII Financial data Health data None sensitive

Your scope

—

Answer the questions to see what applies.

EU AI Act risk tier

Not in scope

You indicated you don't operate in the EU.

Indicative scope based on your answers — applicability turns on specifics. Use it to focus the conversation, not as a compliance determination.

Take the free assessment

What applies to your institution

Frameworks are ordered by how directly they bind you — required first, then recommended.

Email me my regulation scope summary

We'll send a clean summary of the frameworks above, what each one requires, and where institutions like yours most often have gaps. No spam; unsubscribe anytime.

Turn scope into a plan

See exactly where your gaps are.

Knowing which rules apply is step one. The free risk assessment shows where you stand against them — or book a call to scope an expert review.

Take the free Readiness Assessment Book a call See pricing & engagement

Informational only — not legal advice. Regulatory applicability depends on specifics; confirm with counsel.

By Barry Middlebrook · Middlebrook Data & AI Governance · middlebrookdataaigovernance.com
Frameworks: FS AI RMF (U.S. Treasury / CRI) · DAMA-DMBOK · NIST AI RMF · ISO/IEC 42001 · EU AI Act · DORA · SOX · SR 11-7