REGULATIONS & FRAMEWORKS
One set of controls. you answer to.
Most enterprises answer to several AI rules at once. A3R builds one set of controls and maps it to each framework, so you aren’t running a separate program for every regulation.
How the mapping works
A3R’s controls are organized around what runtime-enforced governance looks like: visibility by default, lineage by design, policy enforced at the point of interaction, and accountability mapped to action. Each control produces its evidence once, and that evidence answers the matching requirement in every framework that applies to you.
How our controls map
| A3R control area | NIST AI RMF | ISO/IEC 42001 | EU AI Act (high-risk) | Sector rules |
|---|---|---|---|---|
| AI inventory and risk tiering | Govern, Map | Clause 6 (planning), Annex A | Art. 6 classification, Art. 9 risk management | SR 26-2 (banking), NAIC model bulletin (insurance) |
| Data lineage and quality | Map, Measure | Annex A data controls | Art. 10 data governance | HIPAA (healthcare) |
| Policy enforced at runtime | Manage | Clause 8 (operation) | Art. 9 risk management, Art. 15 accuracy and robustness | ABA Formal Opinion 512 (law) |
| Human oversight and accountability | Govern | Clause 5 (leadership) | Art. 14 human oversight | All sectors |
| Testing and monitoring | Measure | Clause 9 (performance evaluation) | Art. 15, post-market monitoring | SR 26-2, NAIC model bulletin |
| Records and evidence | Govern, Manage | Clause 7.5 (documented information) | Art. 11 technical documentation, Art. 12 record-keeping | All sectors |
| Vendor and third-party AI | Govern, Map | Annex A supplier controls | Deployer obligations | SR 26-2, HIPAA business associates |
This mapping is a summary for orientation. The assessment includes a requirement-by-requirement gap report for the frameworks that apply to you.
What changed in 2026
EU AI Act
High-risk obligations now apply from December 2, 2027 for stand-alone systems and August 2, 2028 for systems embedded in regulated products. Transparency obligations were not deferred.
US banking
In April 2026, the Federal Reserve, FDIC, and OCC replaced SR 11-7 with new model risk management guidance (SR 26-2 / OCC Bulletin 2026-13) that takes a more risk-based approach.
US states
State AI laws are changing quickly. Colorado’s law did not take effect as planned, and federal efforts to preempt state laws are being contested. Until courts or Congress decide, state AI laws remain enforceable.
Last reviewed: October 2026.
By industry
Model risk management under SR 26-2, fair lending, and exam evidence.
The NAIC model bulletin adopted by many states, and testing for unfair discrimination.
HIPAA, and clinical summaries every doctor can check against the record.
ABA Formal Opinion 512 and client confidentiality.
Safety, separation from control systems, and documentation for regulators and rate cases.
This page is a summary, not legal advice. Work with your counsel on how each rule applies to your organization.
Start with the assessment.
In about four weeks, you’ll know what AI you’re running, where you stand on the maturity curve, and what to fix first.