§ The CISO Learning Journey · Week 7 · Phase 2 · Diagnosis · June 30, 2026

Twelve frameworks.
One operational requirement.

By Lindsay Hiebert · Founder · CISSP

Twelve regulatory frameworks converging on the same two artifacts: a regulation-anchored AI Acceptable Use Policy plus a documented risk assessment. Different statutes, jurisdictions, industries — same operational requirement.
Different statutes · Same operational requirement

Twelve regulatory frameworks now converge on documented AI governance. EU AI Act (Articles 9, 10, 14, 15, 17 high-risk obligations now December 2, 2027 for Annex III / August 2, 2028 for Annex I per the 2026 Digital Omnibus; Article 50 transparency August 2, 2026; Article 4 literacy in force since February 2, 2025). Colorado SB 26-189 (which repealed and replaced SB 24-205; signed May 14, 2026) — effective January 1, 2027, applies to consequential decisions made on or after that date. HIPAA Security Rule (§ 164.308 administrative safeguards) GDPR (Articles 28, 35). CCPA/CPRA. SOC 2 (CC5.3, CC6.1, CC7.2). NIST AI RMF (GOVERN, MAP, MEASURE, MANAGE functions). ISO/IEC 42001 (Clauses 6, 8.3, 10). ISO/IEC 27001. NAIC AI Model Bulletin (adopted in 20+ U.S. states). DORA (Reg. (EU) 2022/2554, ESA enforcement active since January 2025). NYC Local Law 144 (bias audit for automated employment decision tools, DCWP-enforced since July 5, 2023). Different statutes, jurisdictions, and industries. Same operational requirement.

Every one of them asks for the same two artifacts: a regulation-anchored AI Acceptable Use Policy and a documented risk assessment of the AI in use. Generic AUP templates that are not clause-anchored cannot satisfy any of them at audit level — the auditor’s question is not “do you have an AUP” but “show me the section that satisfies Article 17(c).” Per-framework consulting engagements ($40K–$150K each from the Big 4 advisory firms) cover one framework at a time and produce snapshots that drift the moment a regulator amends a clause. Vendor self-attestation tools (SIG, Vanta, Drata) cover the controls side of these frameworks at the vendor program level but cannot generate the regulation-anchored documented evidence the frameworks require as artifacts.

What to do. Produce one artifact that anchors to all twelve frameworks at clause level — and refresh it as the landscape shifts. SanctumShield’s multi-LLM agentic synthesis layer (Claude + Gemini) maps each generated AUP section to the specific clauses it satisfies across the twelve frameworks, refreshed monthly as regulators amend obligations and as new state and sectoral bulletins land. Next step: see the framework mapping in a real Acme Health audit at /sample-outputs.

§ Why this is a legal question, not a tooling preference

Everything above is an argument about method. Underneath it sits an obligation that does not depend on which method you pick. Documented, dated, demonstrable governance is what the law asks for, and the dates have stopped being in the future.

EU AI Act Article 4 — AI literacy
In force since February 2, 2025. National enforcement began August 2, 2026.
EU AI Act Article 50 — transparency
Applies since August 2, 2026.
Colorado SB 26-189
Effective January 1, 2027.
EU AI Act Articles 12, 14 and 17 — record-keeping, human oversight, quality management
High-risk regime: December 2, 2027 (Annex III) and August 2, 2028 (Annex I).

Read those together and the shape is consistent. Each one asks an organization to produce something — a measure taken, a disclosure made, a record kept, a review performed — and to be able to show it after the fact. None of them names a product, a platform or a link, and nothing here should be read as saying a law requires one. What a law requires is the record. Making that record dated and third-party-verifiable is simply how you let an auditor, an underwriter or a board confirm it without being handed the contents, or being asked to take your word for it.

And literacy is not one obligation among several. It is the one the others rest on. You cannot exercise due diligence over a system you cannot recognise, and you cannot govern an authority you do not understand you have delegated.

That is why Article 4 sits in the opening chapter of the Act, ahead of the risk tiers, and why it applied eighteen months before the high-risk regime does. The duty is to take measures that support the development of AI literacy among the people operating AI on the organization’s behalf — and the useful version of that is matched to the seat. What a director needs to recognise is not what a developer needs to recognise, and neither is what the person pasting a contract into a browser tab needs to recognise. A single org-wide module satisfies the form and misses the point.

Free board register + eight questions →Literacy matched to the seat →Free risk calculator →
Continue exploring on SanctumShield

The full library — 290 pages of CISO-grade content.

SanctumShield maintains the deepest publicly-available reference set for mid-market agentic-AI governance — primary-source cited, continuously refreshed. Related deep-dives on this article’s topic:

Free Shadow AI Risk Audit

See what your current stack is missing — in 12 questions.

The SanctumShield free Shadow AI Risk Calculator runs in your browser. No account, no email, no credit card. Twelve questions, instant risk score, three primary findings tailored to what you submit.

CISO Learning Journey: Week 7 of 27 · Phase 2 (Diagnosis) · see the full series →

Twelve Frameworks. One Operational Requirement. — SanctumShield