Compliance & regulation

The AI rules are here. Know what they require.

From the EU AI Act to Colorado's automated-decision law, the obligations are concrete — and dated. Northgale maps your explainability and audit trail to each one, so your explanation is your compliance evidence.

EU AI Act — Article 50

In force Aug 2, 2026
Applies to
Providers and deployers of AI systems that interact with people or generate synthetic content — not only high-risk systems.
Requires
Transparency: tell people they are interacting with AI, mark AI-generated content, and document compliance.
How Northgale maps
Norma generates plain-language explanations and a labeled audit trail you can surface at the point of interaction and produce on request.

Colorado SB 26-189

Effective Jan 1, 2027
Applies to
Deployers of automated decision-making that materially influences consequential decisions (employment, credit, insurance, housing, healthcare).
Requires
Pre-use consumer notices, 30-day adverse-outcome explanations, meaningful human review, and developer documentation.
How Northgale maps
A Norma decision card is a ready-made adverse-outcome explanation — reasons, evidence, and next steps — exportable in 30 days or 30 seconds.

NIST AI RMF

Voluntary, increasingly referenced
Applies to
Organizations governing AI risk; mapped into federal frameworks (e.g., Treasury's 2026 financial-services controls).
Requires
Govern, Map, Measure, Manage — documented risk management across the AI lifecycle.
How Northgale maps
Norma's evidence trail and confidence scoring operationalize the “Measure” and “Manage” functions with a permanent record.

CFPB — adverse action

Active
Applies to
Lenders and financial institutions using AI in credit decisions.
Requires
Adverse action notices with the specific principal reasons for a denial.
How Northgale maps
Norma surfaces the exact reasons behind a credit decision, formatted for an adverse action notice.

EEOC — AI in employment

Active
Applies to
Employers using AI in hiring, promotion, and performance decisions.
Requires
Non-discrimination and the ability to explain consequential employment decisions.
How Northgale maps
Norma explains each employment recommendation with its inputs and flags disparity risk before a decision is finalized.

Frequently asked questions

What is AI explainability, and why does it matter for compliance?

AI explainability is the practice of making an AI system's outputs understandable in plain language — the reasoning, the evidence, and the confidence behind a decision. Regulators increasingly require it: the EU AI Act, Colorado SB 26-189, and CFPB rules all demand that consequential AI decisions be explainable to the people they affect. Explainability is how a compliance team proves a decision was defensible.

Does the EU AI Act require explainability?

The EU AI Act requires transparency across the board (Article 50 applies to many AI systems, not only high-risk ones) and imposes documentation, human oversight, and logging obligations on high-risk systems. An explainability layer that records reasoning, evidence, and confidence is the practical way to satisfy these obligations.

What does Colorado SB 26-189 require?

Effective January 1, 2027, Colorado's automated decision-making law requires deployers of consequential-decision AI to provide pre-use notices, 30-day explanations of adverse outcomes, meaningful human review, and developer documentation. An automated decision card — reasons, evidence, and next steps — satisfies the explanation requirement on demand.

Is NIST AI RMF mandatory?

NIST's AI Risk Management Framework is voluntary, but it is referenced by state laws and federal frameworks, and is the de facto standard for documenting AI governance in the United States. Mapping your audit trail to its Govern/Map/Measure/Manage functions is the strongest, most portable compliance posture.

How does an audit trail help during a regulatory exam?

During an exam or audit, the question is always “how did you reach this decision, and what evidence did you have?” An immutable, exportable audit trail — captured at the moment of the decision, not reconstructed afterward — turns that question from a scramble into a report.

Does Northgale provide legal advice?

No. Northgale is technical infrastructure that documents and explains AI decisions. It is not legal or compliance advice. You remain responsible for your compliance obligations and should consult qualified counsel.

See how your audit trail maps to these rules.