AI compliance is not a product feature or a universal checklist. It is a versioned decision system that connects a specific jurisdiction, role, use, provision, date, and transition rule to engineering controls and reviewable evidence. This guide covers that control plane across the EU AI Act, China's synthetic-content labeling rules, and the voluntary NIST AI RMF.

For a deep implementation checklist focused on EU high-risk systems, use the EU AI Act developer safety checklist. For Article 6 and high-risk control design, use the high-risk systems engineering guide. This page instead owns cross-jurisdiction applicability, evidence contracts, and change management.

Key Takeaways

  • Separate binding law, regulator guidance, voluntary frameworks, engineering controls, and evidence artifacts.
  • Treat the current EU timetable as staged: Article 50 applies from 2 August 2026, Annex III high-risk rules from 2 December 2027, and Annex I product-embedded high-risk rules from 2 August 2028.
  • Do not equate machine-readable marking, visible labelling, provenance metadata, and digital watermarking.
  • China's rules require scope and role analysis; applicable metadata duties do not make digital watermarking universally mandatory.
  • NIST AI RMF 1.0 is voluntary and being revised. It is a control vocabulary, not a legal certificate.
  • Reclassify after changes to law, role, intended purpose, geography, model, data, tools, distribution path, or incident history.

Five Layers That Must Not Collapse

Layer What it establishes What it does not establish
Binding law Duties for a defined subject and fact pattern The exact implementation for every architecture
Regulator guidance or code Interpretation or a recognized compliance route A replacement for the legal text
Voluntary framework Risk vocabulary and control structure Legal applicability or certification
Engineering control A mechanism that implements a requirement That the requirement applies or is fully satisfied
Evidence artifact What happened, under which version, with which result The legal conclusion itself

A watermark detector can be a control. Its test report can be evidence. Neither proves that Article 50 applies to a specific product or that the chosen implementation is adequate.

Build the Applicability Record First

Every release should resolve or explicitly escalate these fields:

Dimension Required record
Jurisdiction Country or region, market-placement and output-use facts
Role Provider, deployer, importer, distributor, platform, or other covered actor
System Intended purpose, affected decision, users, model and tool boundaries
Source Exact law, article, guidance, standard, amendment state, and retrieval date
Classification Applicable, not applicable, uncertain, or prohibited, with reasoning
Owner Legal, product, security, data, and operational approvers
Change trigger Facts that force reassessment and the maximum review interval
flowchart LR A["Facts: jurisdiction, role, use"] --> B["Current source and transition rule"] B --> C["Applicability decision"] C --> D["Obligation and owner"] D --> E["Control and test"] E --> F["Evidence and release decision"] F --> G["Monitor change triggers"] G -->|law, model, data, geography, incident| A

Do not copy a control library into a release ticket and call it an applicability assessment. The same technical system can move between categories when its intended purpose, customer workflow, or operator role changes.

EU AI Act: Use the Amended Timeline

The official AI Act Service Desk timeline incorporates the Digital Omnibus amendments:

Date Official milestone Engineering implication
2 February 2025 General provisions, AI literacy, and prohibitions apply Maintain literacy evidence and prohibited-use gates where applicable
2 August 2025 GPAI obligations and governance apply Classify GPAI provider and downstream roles
2 August 2026 Article 50 transparency rules apply; enforcement starts for applicable rules Test provider marking/detection and deployer disclosure duties by scenario
2 December 2026 Additional prohibitions and Article 50(2) transition apply Identify covered pre-existing synthetic-content systems
2 December 2027 Annex III high-risk rules apply Prepare use-case high-risk controls and evidence
2 August 2028 Annex I product-embedded high-risk rules apply Align AI and regulated-product assurance lifecycles

These dates are planning inputs, not classifications. Record the current consolidated text, applicable transition, and guidance used for each decision.

Article 50 Is Not One Generic Watermark Rule

The Commission describes different responsibilities:

  • Providers of relevant generative AI systems address machine-readable marking and detection of generated or manipulated outputs, subject to technical feasibility and the state of the art.
  • Deployers address disclosure or labelling for deepfakes and specified AI-generated or manipulated public-interest text.
  • The transparency Code of Practice is voluntary, while applicable Article 50 obligations are legal requirements.

Therefore, test each output path separately: API response, chat UI, download, copy, crop, transcode, edit, repost, and platform ingestion. Record where marking survives, where a visible disclosure is presented, and where a transformation breaks the chain. Do not claim that a C2PA manifest, an invisible signal, or a badge satisfies every case.

China: Explicit Labels, Metadata, and Watermarks Are Different

The Measures for Labeling AI-Generated Synthetic Content took effect on 1 September 2025. Their scope is tied to covered network information service providers and related algorithm recommendation, deep synthesis, and generative AI service rules.

Mechanism Official treatment Engineering test
Explicit label User-perceptible text, sound, graphic, or interface notice in applicable scenarios Visibility, wording, placement, accessibility, export
Implicit label Required information in file metadata in applicable cases Field presence, encoding, integrity, propagation
Digital watermark Encouraged as a possible implicit-marking technique Detectability under declared transformations and false-positive controls
Platform notice Based on metadata, user declaration, explicit marks, or detected traces Ingestion, declaration, relabelling, and audit path

The official FAQ states that multimedia digital watermarking and text implicit marking are not universally mandated because of technical and cost constraints. That qualification matters: metadata is not synonymous with a watermark, and an encouraged watermark is not a universal dual-watermark rule.

Article 9 also defines a specific route for supplying content without an explicit label after contractual responsibilities and legally required logging conditions are met. Do not generalize its six-month record requirement to every AI log. Store only evidence with a defined purpose, access policy, retention basis, deletion behavior, and legal-hold path.

NIST AI RMF: Map Controls Without Inventing Certification

NIST still publishes AI RMF 1.0, states that it is being revised, and describes it as voluntary. NIST AI 600-1 is the Generative AI Profile.

Function Useful artifact Release question
GOVERN Accountability map, policy register, exception log Who can approve, pause, or retire the system?
MAP Use-case, affected-party, and data-flow inventory Are scope and harm assumptions current?
MEASURE Evaluation manifest, slices, uncertainty, incident metrics Does evidence cover the deployed version and context?
MANAGE Mitigation, acceptance, escalation, and rollback records Are residual risks owned and monitored?

Map NIST outcomes to applicable duties when useful, but keep the source layers distinct. “Mapped to NIST” is not “compliant with the EU AI Act,” and the current official framework remains AI RMF 1.0 while its revision is underway.

The Obligation-Control-Evidence Ledger

Use one ledger row per obligation and fact pattern:

Field Example
source_id eu-ai-act:article-50-2
source_version Consolidated text plus adopted amendment identifier
subject_and_scope Provider; specified output path; EU market facts
obligation Machine-readable marking and detectability
control_id synthetic-output-marking-v4
test_id export-transformation-suite@sha256:...
evidence_uri Immutable report with restricted access
decision Pass, fail, exception, or not applicable
approved_by Named legal and engineering owners
reassess_on Source, model, format, role, or distribution change

The following dependency-free validator checks release mechanics. It does not make a legal determination:

python 
from dataclasses import dataclass
from datetime import date

ALLOWED_DECISIONS = {"pass", "fail", "exception", "not_applicable"}

@dataclass(frozen=True)
class EvidenceGate:
    source_id: str
    source_version: str
    role: str
    obligation: str
    control_id: str
    test_id: str
    evidence_uri: str
    decision: str
    approved_by: tuple[str, ...]
    review_due: date

def validate_gate(gate: EvidenceGate, release_date: date) -> None:
    required = (
        gate.source_id, gate.source_version, gate.role, gate.obligation,
        gate.control_id, gate.test_id, gate.evidence_uri,
    )
    if any(not value.strip() for value in required):
        raise ValueError("source, scope, control, test, and evidence are required")
    if gate.decision not in ALLOWED_DECISIONS:
        raise ValueError("unknown decision")
    if gate.decision in {"pass", "exception"} and len(gate.approved_by) < 2:
        raise ValueError("legal and engineering approvals are required")
    if gate.review_due < release_date:
        raise ValueError("applicability review is stale")

gate = EvidenceGate(
    source_id="eu-ai-act:article-50-2",
    source_version="consolidated+digital-omnibus",
    role="provider",
    obligation="mark applicable synthetic outputs",
    control_id="marking-v4",
    test_id="transform-suite:sha256-8f1",
    evidence_uri="evidence://restricted/report-842",
    decision="pass",
    approved_by=("legal-owner", "engineering-owner"),
    review_due=date(2026, 10, 1),
)
validate_gate(gate, release_date=date(2026, 8, 9))
print("release evidence is current")
# Output: release evidence is current

The production gate should also verify that referenced artifacts exist, signatures or hashes match, approvers are authorized, exceptions have expiry dates, and privacy controls apply to the evidence store.

Reclassification and Operational Controls

Re-run applicability and tests when any of these change:

  • A law, amendment, regulator guideline, code, or technical standard.
  • Provider, deployer, platform, or contractual role.
  • Intended purpose, affected decision, user group, or geography.
  • Model, prompt, tool permission, dataset, retrieval source, or vendor.
  • Output format, export path, label mechanism, or distribution platform.
  • Incident, complaint, bypass, drift, or newly discovered affected group.

Operational evidence needs deletion as well as creation. Maintain source-to-artifact lineage, tenant and object authorization, privacy-aware redaction, retention expiry, legal hold, deletion propagation, incident preservation, and rollback. A tamper-evident log can protect integrity, but it must not become an indefinite store of prompts, secrets, or personal data.

Release Review

Before release, require:

  1. A current applicability record for each jurisdiction and role.
  2. Exact provision and transition references, not a generic regulation name.
  3. An owner, control, test, evidence artifact, and unresolved exception for each duty.
  4. Scenario tests for normal, adversarial, multilingual, export, deletion, and failure paths.
  5. Independent approval from qualified legal and domain reviewers.
  6. Reassessment triggers, monitoring signals, rollback authority, and a review date.

This process produces a defensible engineering record, not an automatic legal conclusion. Source text and official guidance remain authoritative.

Primary Sources