The episode makes three points:

• Who signs off: the business owner owns the yes. An independent second line (risk, compliance, privacy, model validation) owns the “not yet.” Its real power is refusing or attaching conditions to validation.
• Who can stop it: US federal policy and the EU AI Act spell this out most clearly. Under the White House AI memo (M-25-21), only the agency’s Chief AI Officer can let a non-compliant system keep running, and that power can’t be delegated. Under the EU AI Act, the provider builds the stop button (Art 14) and the deployer decides when to suspend use (Art 26(5)). Microsoft and IBM’s review boards mostly attach conditions rather than veto. Hosts recommend agreeing stop triggers before launch.
• Combined risk across business lines: your follower is right. US bank guidance tracked “aggregate model risk” for 15 years, but the April 2026 replacement for SR 11-7 (SR 26-2) leaves generative and agentic AI out of scope. Vendor concentration is real: in UK finance the top three providers account for 44% of named model providers.

Episode Overview

AI regulation is moving from principles to binding rules and formal standards. This episode of Checks & Algorithms examines the EU AI Act, emerging AI laws in other jurisdictions, and the voluntary frameworks organizations use to manage AI risk, including the NIST AI RMF and ISO/IEC 42001. It is designed for candidates preparing for the IAPP AIGP certification and for anyone who needs a clear map of the global AI governance landscape.

Topics Covered

• EU AI Act Risk Tiers: Prohibited practices such as government social scoring, manipulative techniques targeting vulnerable groups, untargeted facial image scraping, and real-time remote biometric identification by law enforcement, with narrow exceptions; high-risk systems in areas such as employment, credit, education, critical infrastructure, and law enforcement, and their requirements for risk management, data governance, documentation, logging, transparency, and human oversight; transparency obligations for chatbots and deepfakes; and voluntary codes of conduct for minimal-risk AI.
• General-Purpose AI Models: Obligations for GPAI model providers, and additional requirements for models with systemic risk, presumed above 10^25 FLOPs of training compute.
• Enforcement and Penalties: Fines of up to €35 million or 7% of global annual turnover for prohibited practices, and up to €15 million or 3% for most other violations.
• Global AI Laws: Canada's proposed Artificial Intelligence and Data Act (AIDA) and what it would have required, US state laws on high-risk automated decision tools, and China's CAC rules on algorithm registration, security reviews, and labeling of generative AI content.
• NIST AI Risk Management Framework: The four core functions, Govern, Map, Measure, and Manage, and NIST's ARIA program for assessing AI risks and impacts.
• International Standards: ISO/IEC 42001 for AI management systems, ISO/IEC 22989 for AI terminology and concepts, ISO 31000 for enterprise risk management, and the Council of Europe's HUDERIA methodology for human rights, democracy, and rule of law impact assessments.

Intended Audience

• AIGP Candidates: Coverage aligned with Domain IV, Understanding Emerging AI Laws, Standards, and Frameworks.
• Compliance Officers and DPOs: Preparing for EU AI Act conformity assessments, GPAI obligations, and cross-border requirements.
• Enterprise Risk Managers: Implementing the NIST AI RMF and preparing for ISO/IEC 42001 certification.

Checks & Algorithms is a podcast on AI governance, covering the policies, standards, and accountability practices shaping artificial intelligence.

Episode Overview

AI-specific laws are still taking shape, but AI is already regulated. This episode of Checks & Algorithms examines how existing legal frameworks apply to artificial intelligence today, across consumer protection, civil rights, intellectual property, product liability, and EU data and platform rules. It is designed for candidates preparing for the IAPP AIGP certification and for anyone who wants to understand where AI accountability already sits in current law.

Topics Covered

• Consumer Protection: How the FTC uses Section 5 of the FTC Act against deceptive AI marketing, inflated accuracy claims, and unfair automated outcomes; COPPA requirements for data collection and profiling of children under 13; and GLBA safeguards for financial data used in automated credit models.
• Non-Discrimination in Hiring and Lending: Disparate treatment and disparate impact under Title VII; adverse action notices under the Fair Credit Reporting Act; NYC Local Law 144 bias audits, candidate notice, and published audit results for automated employment decision tools; and the Illinois AI Video Interview Act's notice, consent, and deletion requirements.
• Intellectual Property: Why copyright protection requires human authorship, and why the USPTO and EPO require patent inventors to be natural persons.
• Product Liability: Whether AI software is treated as a product, subject to strict liability, or a service, subject to negligence, and how causation is established when model outputs cause harm.
• GDPR Article 22: The right not to be subject to solely automated decisions with legal or similarly significant effects; the contract, legal authorization, and explicit consent exceptions; and the required safeguards of human intervention, the right to express a point of view, and the right to contest.
• DPIA vs. AI Conformity Assessment: How a GDPR Article 35 Data Protection Impact Assessment differs from a conformity assessment for high-risk systems under the EU AI Act.
• EU Digital Services Act: Transparency obligations for recommender systems, including disclosure of the main parameters behind recommendations and options for users to change or opt out of profiling-based recommendations.

Intended Audience

• AIGP Candidates: Coverage aligned with Domain III, Understanding How Existing Laws Apply to AI.
• Legal Counsel and HR Leaders: Practical context on NYC Local Law 144, Title VII liability for algorithmic bias, and FCRA adverse action notices.
• Privacy Officers and DPOs: Guidance on aligning GDPR Article 22, DPIAs, and recommender system disclosures with enterprise AI deployments.

Checks & Algorithms is a podcast on AI governance, covering the policies, standards, and accountability practices shaping artificial intelligence.