The episode makes three points:

• Who signs off: the business owner owns the yes. An independent second line (risk, compliance, privacy, model validation) owns the “not yet.” Its real power is refusing or attaching conditions to validation.
• Who can stop it: US federal policy and the EU AI Act spell this out most clearly. Under the White House AI memo (M-25-21), only the agency’s Chief AI Officer can let a non-compliant system keep running, and that power can’t be delegated. Under the EU AI Act, the provider builds the stop button (Art 14) and the deployer decides when to suspend use (Art 26(5)). Microsoft and IBM’s review boards mostly attach conditions rather than veto. Hosts recommend agreeing stop triggers before launch.
• Combined risk across business lines: your follower is right. US bank guidance tracked “aggregate model risk” for 15 years, but the April 2026 replacement for SR 11-7 (SR 26-2) leaves generative and agentic AI out of scope. Vendor concentration is real: in UK finance the top three providers account for 44% of named model providers.

Episode Overview

AI regulation is moving from principles to binding rules and formal standards. This episode of Checks & Algorithms examines the EU AI Act, emerging AI laws in other jurisdictions, and the voluntary frameworks organizations use to manage AI risk, including the NIST AI RMF and ISO/IEC 42001. It is designed for candidates preparing for the IAPP AIGP certification and for anyone who needs a clear map of the global AI governance landscape.

Topics Covered

• EU AI Act Risk Tiers: Prohibited practices such as government social scoring, manipulative techniques targeting vulnerable groups, untargeted facial image scraping, and real-time remote biometric identification by law enforcement, with narrow exceptions; high-risk systems in areas such as employment, credit, education, critical infrastructure, and law enforcement, and their requirements for risk management, data governance, documentation, logging, transparency, and human oversight; transparency obligations for chatbots and deepfakes; and voluntary codes of conduct for minimal-risk AI.
• General-Purpose AI Models: Obligations for GPAI model providers, and additional requirements for models with systemic risk, presumed above 10^25 FLOPs of training compute.
• Enforcement and Penalties: Fines of up to €35 million or 7% of global annual turnover for prohibited practices, and up to €15 million or 3% for most other violations.
• Global AI Laws: Canada's proposed Artificial Intelligence and Data Act (AIDA) and what it would have required, US state laws on high-risk automated decision tools, and China's CAC rules on algorithm registration, security reviews, and labeling of generative AI content.
• NIST AI Risk Management Framework: The four core functions, Govern, Map, Measure, and Manage, and NIST's ARIA program for assessing AI risks and impacts.
• International Standards: ISO/IEC 42001 for AI management systems, ISO/IEC 22989 for AI terminology and concepts, ISO 31000 for enterprise risk management, and the Council of Europe's HUDERIA methodology for human rights, democracy, and rule of law impact assessments.

Intended Audience

• AIGP Candidates: Coverage aligned with Domain IV, Understanding Emerging AI Laws, Standards, and Frameworks.
• Compliance Officers and DPOs: Preparing for EU AI Act conformity assessments, GPAI obligations, and cross-border requirements.
• Enterprise Risk Managers: Implementing the NIST AI RMF and preparing for ISO/IEC 42001 certification.

Checks & Algorithms is a podcast on AI governance, covering the policies, standards, and accountability practices shaping artificial intelligence.

Episode Overview

AI-specific laws are still taking shape, but AI is already regulated. This episode of Checks & Algorithms examines how existing legal frameworks apply to artificial intelligence today, across consumer protection, civil rights, intellectual property, product liability, and EU data and platform rules. It is designed for candidates preparing for the IAPP AIGP certification and for anyone who wants to understand where AI accountability already sits in current law.

Topics Covered

• Consumer Protection: How the FTC uses Section 5 of the FTC Act against deceptive AI marketing, inflated accuracy claims, and unfair automated outcomes; COPPA requirements for data collection and profiling of children under 13; and GLBA safeguards for financial data used in automated credit models.
• Non-Discrimination in Hiring and Lending: Disparate treatment and disparate impact under Title VII; adverse action notices under the Fair Credit Reporting Act; NYC Local Law 144 bias audits, candidate notice, and published audit results for automated employment decision tools; and the Illinois AI Video Interview Act's notice, consent, and deletion requirements.
• Intellectual Property: Why copyright protection requires human authorship, and why the USPTO and EPO require patent inventors to be natural persons.
• Product Liability: Whether AI software is treated as a product, subject to strict liability, or a service, subject to negligence, and how causation is established when model outputs cause harm.
• GDPR Article 22: The right not to be subject to solely automated decisions with legal or similarly significant effects; the contract, legal authorization, and explicit consent exceptions; and the required safeguards of human intervention, the right to express a point of view, and the right to contest.
• DPIA vs. AI Conformity Assessment: How a GDPR Article 35 Data Protection Impact Assessment differs from a conformity assessment for high-risk systems under the EU AI Act.
• EU Digital Services Act: Transparency obligations for recommender systems, including disclosure of the main parameters behind recommendations and options for users to change or opt out of profiling-based recommendations.

Intended Audience

• AIGP Candidates: Coverage aligned with Domain III, Understanding How Existing Laws Apply to AI.
• Legal Counsel and HR Leaders: Practical context on NYC Local Law 144, Title VII liability for algorithmic bias, and FCRA adverse action notices.
• Privacy Officers and DPOs: Guidance on aligning GDPR Article 22, DPIAs, and recommender system disclosures with enterprise AI deployments.

Checks & Algorithms is a podcast on AI governance, covering the policies, standards, and accountability practices shaping artificial intelligence.

How do you turn "be ethical" into something an organization can actually manage? In this episode of Checks & Algorithms, we explore the ethical pillars, risk taxonomies, and technical safeguards behind Responsible AI (RAI), bridging high-level principles and day-to-day risk management. It's built for boot camp candidates preparing for the IAPP AIGP exam, and useful for anyone responsible for making AI trustworthy in practice.

**In this episode:**

- **The four levels of AI harm:** Individual harms (surveillance, unfair credit or housing decisions, privacy breaches, physical and psychological injury), group harms (algorithmic bias, disparate impact, profiling), societal harms (deepfakes and disinformation, threats to democratic processes, environmental cost of compute, labor disruption), and corporate and ecosystem risks (reputational damage, IP liability, prompt injection and data poisoning, regulatory fines, supply chain dependencies).

- **Six traits of trustworthy AI:** Accountability and governance; transparency and notice; explainability vs. interpretability, and why explanations matter for adverse action notices in credit and employment; safety, robustness, and reliability against adversarial attacks; privacy and data governance; and fairness and non-discrimination across the AI lifecycle.

- **Privacy-enhancing technologies (PETs):** How federated learning, synthetic data, differential privacy, and homomorphic encryption let teams train and use models while protecting personal data.

- **Global ethical frameworks compared:** The OECD AI Principles, the White House Blueprint for an AI Bill of Rights, the EU High-Level Expert Group's seven requirements and its Assessment List for Trustworthy AI (ALTAI), the UNESCO Recommendation on the Ethics of AI, the IEEE 7000 series, and the Fair Information Practice Principles (FIPPs).

**Who should listen:**

- **AIGP candidates** covering Domain II: AI harms, trustworthy AI principles, and ethical frameworks.

- **Risk management and compliance officers** putting risk taxonomies and PETs to work inside enterprise risk programs.

- **Legal counsel and privacy officers** who want a structured look at explainability requirements, adverse action notices, and global policy frameworks.

Subscribe to Checks & Algorithms for more episodes on the rules, risks, and accountability shaping AI.

Disclaimer: AIGP official source information + Gemini + Human Reviewer