Implement the EU AI Act and OMB M-24-10 without losing momentum

Regulatory landscape

Compliance teams cannot treat AI governance as a single jurisdictional project. The EU, U.S., and Singapore regimes establish overlapping—but distinct—expectations for risk classification, conformity assessments, documentation, and transparency. Understanding the baseline requirements, their enforcement timelines, and the supervisory authorities involved is the starting point for a durable governance roadmap.

European Union: AI Act obligations

The AI Act establishes four risk tiers—unacceptable, high, limited, and minimal—and enforces them through a mix of prohibitions, mandatory controls, and transparency requirements.^{Regulation (EU) 2024/1689} Article 5 prohibits categories such as social scoring by public authorities, predictive policing based on profiling, and biometric categorisation that infers sensitive traits. Article 9 requires providers of high-risk AI systems (Annex III) to implement a risk management system that spans design, development, and post-deployment monitoring. Articles 10 through 15 mandate high-quality data governance, technical documentation, record-keeping, transparency, human oversight, robustness, accuracy, and cybersecurity safeguards. Article 53 adds general-purpose AI obligations, including technical documentation, model evaluation summaries, and energy use disclosures for models with systemic risk potential.

Implementation timing is staggered. Prohibited practices become enforceable on 2 February 2025. General-purpose AI providers must comply with transparency and systemic risk mitigation duties by 2 August 2025. High-risk AI obligations start 2 August 2027, except for Annex III point 5 (critical infrastructure) and point 6 (education) which receive targeted transition support via delegated acts.^{Regulation (EU) 2024/1689} Providers must prepare for conformity assessments under Articles 43 and 44, using harmonised standards or common specifications once adopted. The European AI Office will coordinate cross-border enforcement, publish templates for transparency obligations, and maintain the EU database for high-risk AI systems. Supervisory authorities in member states retain audit powers and can request technical documentation, training data descriptions, and logs on demand.

Organisations deploying AI in the EU must therefore identify whether they act as “providers”, “deployers”, “importers”, or “distributors” under Article 3 definitions. Providers bear the broadest obligations, including quality management systems, technical documentation, and CE marking. Deployers must ensure human oversight, maintain logs, and conduct post-market monitoring. Importers and distributors must verify that CE-marked systems remain compliant and that instructions are available in the appropriate language. Cross-functional mapping between AI systems and these roles ensures the right evidence is prepared for each supervisory request.^{Regulation (EU) 2024/1689}

2025 general-purpose AI enforcement window

The first EU AI Act enforcement milestone for general-purpose AI (GPAI) providers arrives on 2 August 2025, when Article 53 transparency, systemic risk mitigation, and technical documentation duties become mandatory. Providers must publish system cards that describe model capabilities, limitations, energy usage, and foreseeable misuses while supplying regulators with training and evaluation documentation.^{Regulation (EU) 2024/1689European Commission GPAI system card guidance}

European AI Office implementation notices emphasise that GPAI providers should operationalise Article 73 serious-incident reporting alongside transparency measures. The Commission’s consultation closing 7 November 2025 introduced draft reporting templates, 24-hour notification expectations, and post-incident remediation evidence requirements that will apply to both high-risk AI deployers and GPAI providers once the regulation is fully in force.^{Article 73 consultationEuropean AI Office implementing notice}

• Publish model system cards. Track the Commission’s GPAI templates, align disclosures with ISO/IEC 42001 documentation, and stage collateral for harmonised standards adoption once CEN-CENELEC publishes references.^{European Commission GPAI system card guidanceISO/IEC 42001:2023}
• Instrument serious-incident response. Wire monitoring, legal, and policy teams to the Article 73 templates so that 24-hour notifications and subsequent seven- and thirty-day reports can be filed without delay.^{Policy Briefing — November 7, 2025Article 73 consultation}
• Reconcile global assurance. Map GPAI transparency artefacts to U.S. procurement requirements under OMB M-24-10 and Singapore’s Veritas Toolkit so leadership sees a single evidence chain across jurisdictions.^{OMB M-24-10MAS Veritas Toolkit 2.0}

United States: OMB M-24-10

OMB M-24-10 operationalises Section 4 of Executive Order 14110 by mandating that federal agencies inventory safety-impacting and rights-impacting AI use cases, manage associated risks, and report serious incidents promptly.^{Executive Order 14110OMB M-24-10} Section 4.1 requires every agency to designate a Chief AI Officer (CAIO) with authority over AI governance, coordinate with the agency Chief Information Officer, Chief Data Officer, and Chief Information Security Officer, and submit implementation plans to OMB. Section 5 directs agencies to log AI use cases in the government-wide inventory managed by the General Services Administration, including descriptions of intended purpose, data inputs, model ownership, safeguards, and impact assessments. Section 6 instructs agencies to conduct risk assessments, focusing on safety, civil rights, civil liberties, and privacy, before deploying AI. Section 7 sets incident response expectations: serious AI incidents must be reported to OMB and the National AI Initiative Office within 24 hours, followed by seven- and thirty-day reports.^{OMB M-24-10}

OMB’s memorandum also highlights procurement guardrails. Section 8 requires that contracts for AI systems include performance guarantees, transparency provisions, and access for evaluation. Section 9 emphasises public transparency by directing agencies to publish annual reports describing AI use cases, risk mitigations, and waiver requests. Agencies that cannot fully comply may seek alternative measures via Section 10, but they must demonstrate equal or greater protections.^{OMB M-24-10}

Private-sector organisations that sell to the U.S. government or align voluntarily with federal guidance should mirror these controls. Maintaining a CAIO-equivalent role, using the government inventory schema, and preparing 24-hour incident reporting workflows will improve procurement readiness and customer confidence.^{OMB M-24-10} Zeph Tech’s OMB M-24-10 briefing includes templates for inventory submissions, risk assessment checklists, and contracting clauses.

Singapore: Veritas Toolkit 2.0

Singapore’s Monetary Authority launched the Veritas Initiative to translate the nation’s AI governance principles into actionable assessments for the financial sector. Version 2.0 of the Veritas Toolkit, released in 2024, expands beyond credit risk to cover wealth management, insurance, and fraud detection scenarios.^{MAS Veritas Toolkit 2.0} The toolkit provides quantitative and qualitative fairness metrics, data quality diagnostics, explainability testing, and human oversight controls aligned with Singapore’s Model AI Governance Framework. Institutions are expected to apply these assessments at the model development stage, during pre-deployment reviews, and as part of ongoing monitoring.

MAS supervisors have signalled that regulated entities should document governance arrangements, board oversight, and accountability structures for AI and data analytics solutions. The Veritas Toolkit includes governance playbooks, roles and responsibilities matrices, and incident escalation workflows that align with Singapore’s Model AI Governance Framework and related supervisory guidance.^{Model AI Governance Framework} Adopting these templates helps institutions demonstrate that they manage model bias, robustness, and explainability risks proactively. Zeph Tech’s Singapore GenAI governance update summarises the supervisory expectations communicated during 2024 industry briefings.

Multinational organisations should integrate the Veritas assessments into their global governance programs, especially if they operate in regulated financial markets. The toolkit’s scenario-based fairness tests complement the EU AI Act’s Annex III financial services risk categories and provide evidence for U.S. fair lending compliance. Harmonising outputs across jurisdictions reduces duplicative testing and positions teams to respond to MAS, EU, and U.S. regulators with a consistent narrative.

Risk assessment

Risk assessment is the connective tissue between regulatory obligations and operational controls. It requires a structured inventory, multidimensional scoring, and evidence that those scores inform product decisions. ISO/IEC 42001:2023 mandates a risk management process that spans context establishment, risk identification, analysis, evaluation, and treatment for AI systems.^{ISO/IEC 42001:2023} The NIST AI RMF aligns closely: the Govern function directs organisations to define roles, policies, and culture; the Map function inventories systems and stakeholders; the Measure function evaluates risk; and the Manage function treats residual risk.^{NIST AI RMF 1.0}

Zeph Tech recommends the following sequence for risk assessment:

1. Inventory reconciliation. Merge entries from product roadmaps, model registries, data catalogues, and procurement portals into a single AI inventory. Record ownership, deployment status, intended users, affected communities, and jurisdictional exposure. Capture model lineage, including training data sources, fine-tuning datasets, and third-party components.
2. Risk taxonomy alignment. Tag each system with AI Act risk tiers, OMB M-24-10 use case categories (safety-impacting versus rights-impacting), and Veritas Toolkit scenario types. Maintain crosswalk tables so that regulatory reporting pulls from the same canonical fields.
3. Context capture. Document the business objectives, decision points, human oversight arrangements, and data flows. ISO/IEC 42001 Clause 6.1.2 calls for understanding internal and external issues that affect AI risk; NIST AI RMF Map function Task 1.2 requires identifying intended purposes and benefits.^{ISO/IEC 42001:2023NIST AI RMF 1.0}
4. Hazard identification. Use cross-functional workshops to enumerate potential harms: safety failures, discriminatory outcomes, privacy breaches, security compromises, environmental impacts, and reputational damage. Draw from Annex III of the AI Act, NIST RMF Catalogs, and Veritas fairness risk scenarios.^{Regulation (EU) 2024/1689NIST AI RMF 1.0MAS Veritas Toolkit 2.0}
5. Risk analysis. Quantify likelihood and impact across regulatory, operational, financial, and reputational dimensions. For high-risk AI, align with Article 9(2) requirements to test risk management measures before placing the system on the market. For U.S. government-aligned use cases, integrate M-24-10’s required impact assessment questions.^{Regulation (EU) 2024/1689OMB M-24-10}
6. Risk evaluation and treatment. Prioritise mitigation strategies, assign accountable owners, and define treatment timelines. Document risk acceptance decisions with justification and sign-off by the CAIO or equivalent role.

Maintain traceability by linking each risk assessment to supporting evidence: model evaluation reports, red-teaming results, data quality analyses, and fairness metrics. Use Zeph Tech’s model evaluation briefing to benchmark generative AI test coverage and AI Act enforcement update for upcoming supervisory expectations. The assessment process should culminate in a risk statement that drives control implementation and informs the reporting metrics described later in this guide.

For global organisations, harmonise risk scoring scales across regions. Assign translation layers so that an EU “high-risk” classification automatically triggers U.S. incident readiness drills and Singapore fairness assessments. Incorporate supply chain dependencies: Article 28 of the AI Act imposes obligations on deployers using third-party general-purpose AI models, while OMB M-24-10 expects agencies to evaluate contractor-provided systems.^{Regulation (EU) 2024/1689OMB M-24-10} Record each third-party dependency, associated certifications (ISO/IEC 27001, SOC 2), and contractual risk-sharing clauses.

Finally, plan for periodic review. ISO/IEC 42001 Clause 9.1 requires monitoring, measurement, analysis, and evaluation of the AI management system.^{ISO/IEC 42001:2023} Set quarterly cadences to revisit risk ratings, confirm control effectiveness, and capture emerging threats such as model extraction or data poisoning. Document review outcomes in governance tools so auditors can see a continuous record of decision-making.

Controls

Controls translate risk assessments into operational safeguards. They span governance structures, lifecycle management, technical guardrails, and documentation obligations. Aligning these controls with ISO/IEC 42001 and the NIST AI RMF demonstrates maturity to regulators and customers.

Governance and accountability

ISO/IEC 42001 Clauses 5 and 7 emphasise leadership commitment, roles, competence, and awareness. Establish an AI governance charter approved by the board or executive committee. Assign a CAIO or equivalent who chairs an AI risk committee with representation from engineering, data science, legal, compliance, security, and affected business units. Document responsibilities for model owners, data stewards, human oversight leads, and incident coordinators. Article 29 of the AI Act requires deployers to ensure human oversight and to monitor for foreseeable misuse; this should be codified in runbooks with explicit escalation thresholds.^{Regulation (EU) 2024/1689}

Create decision logs for key milestones: greenlighting training datasets, approving model architectures, authorising deployment, and evaluating post-market performance. These logs support Article 18 record-keeping requirements and provide the audit trail demanded by OMB M-24-10 Section 6.^{Regulation (EU) 2024/1689OMB M-24-10} Maintain a repository of policies covering responsible AI principles, data governance, acceptable use, and third-party AI procurement. Ensure policies reference statutory obligations explicitly to make compliance traceable.

Lifecycle management

Lifecycle controls align with the NIST AI RMF Manage function. Require design reviews that evaluate fairness, safety, and security before training begins. Document data sourcing decisions and perform Article 10-compliant data governance checks: bias assessments, data cleaning procedures, and privacy protections. During development, enforce secure coding practices, adversarial testing, and explainability evaluations. Use the Veritas Toolkit’s fairness assessment modules for financial use cases and integrate their outputs into model cards.^{NIST AI RMF 1.0Regulation (EU) 2024/1689MAS Veritas Toolkit 2.0}

Before deployment, conduct conformity assessments. For EU high-risk systems, follow Annex VII quality management system requirements and Annex VIII post-market monitoring plans. For U.S. federal-aligned systems, complete M-24-10 risk assessments and submit them to the CAIO for approval. For Singapore deployments, run Veritas scenario tests and board-level attestation checklists. Store all approvals, test results, and mitigation plans in a document management system with version control.^{Regulation (EU) 2024/1689OMB M-24-10MAS Veritas Toolkit 2.0}

Post-deployment controls include continuous monitoring, human-in-the-loop oversight, and incident management. Article 72 obligates providers to report serious incidents and malfunctioning that constitutes a breach of obligations to market surveillance authorities. Align this with OMB’s 24-hour reporting requirement by rehearsing incident simulations and maintaining contact lists. Implement automated monitoring for data drift, performance degradation, and bias metrics. Capture logs that show interventions and corrections to support Article 12 transparency expectations.^{Regulation (EU) 2024/1689OMB M-24-10}

Technical guardrails

Technical controls should provide defence-in-depth. Leverage access control and segregation of duties for model training environments. Implement reproducible pipelines so that every model artefact can be traced back to its source code, configuration, and data snapshot. Apply encryption for data at rest and in transit, especially when handling sensitive biometric or financial data governed by Articles 10 and 54.^{Regulation (EU) 2024/1689}

For general-purpose AI (GPAI) integration, Article 53 requires providers to publish technical documentation and maintain adequate cybersecurity to address systemic risks. Establish evaluation harnesses that test for jailbreak resilience, harmful content generation, and safety alignment. Record prompts, outputs, and remediation actions. Use adversarial testing frameworks and red teaming exercises consistent with NIST AI RMF Task 3.3 to surface vulnerabilities. Document results and remediations in the risk register.^{Regulation (EU) 2024/1689NIST AI RMF 1.0}

Complement automated testing with human oversight. Define decision thresholds where human approval is mandatory, especially for safety-critical functions such as medical device triage or financial risk scoring. Provide oversight staff with clear guidance, playbooks, and escalation authority. Train them on the limitations and failure modes identified during risk assessments.^{Regulation (EU) 2024/1689}

Documentation and transparency

Documentation is both a compliance requirement and a communication tool. Article 11 mandates technical documentation describing model design, training data, performance metrics, and risk management measures. Article 12 requires record-keeping that enables traceability. Prepare documentation templates that capture these elements consistently. Include sections for intended purpose, performance characteristics, limitations, human oversight provisions, and incident history.^{Regulation (EU) 2024/1689}

OMB M-24-10 Section 9 requires agencies to publish annual reports summarising AI use, risk mitigations, and waiver requests. Private organisations can adapt this format for transparency reports to customers and regulators. Singapore’s Model AI Governance Framework encourages organisations to disclose how AI decisions are made and how individuals can seek recourse. Provide user-facing notices, appeals mechanisms, and contact channels. Maintain version histories for all public disclosures so you can demonstrate timely updates during audits.^{OMB M-24-10Model AI Governance Framework}

Finally, track harmonised standards and guidance that support conformity. Article 40 enables harmonised standards to create a presumption of conformity for AI Act requirements, while Article 41 allows the Commission to issue common specifications.^{Regulation (EU) 2024/1689} Monitor releases and map each standard to your controls. Zeph Tech’s AI Act publication briefing and GPAI obligations roadmap provide ongoing coverage of standards development.

Tooling

Effective AI governance tooling connects inventories, risk assessments, control execution, and reporting. Choose platforms that integrate with existing developer workflows while providing compliance teams with the evidence they need.

Inventory and portfolio management

Adopt a centralised AI registry that synchronises with version control systems, experiment trackers, and model deployment platforms. Each entry should include metadata required by the AI Act database (Article 60), OMB M-24-10 inventory submissions, and Veritas governance templates. Use APIs to ingest deployment status, owner assignments, and monitoring endpoints automatically. Implement data quality checks to ensure entries remain complete and timely.^{Regulation (EU) 2024/1689OMB M-24-10MAS Veritas Toolkit 2.0}

Integrate the registry with service catalogues and procurement systems so new AI acquisitions trigger governance workflows. Configure role-based access controls so only authorised personnel can modify critical fields. Provide dashboards for executives showing inventory growth, risk tier distribution, and compliance coverage. Zeph Tech’s inventory automation briefing demonstrates how to extend CI/CD pipelines to update registry entries during deployment.

Risk and control execution

Leverage governance, risk, and compliance (GRC) platforms or custom workflow tools to run risk assessments, approvals, and control attestations. Embed ISO/IEC 42001 and NIST AI RMF control catalogs into the tool to standardise evaluation criteria. Provide automation hooks to request fairness tests, security scans, and explainability analyses. Ensure the tool captures reviewer comments, decision logs, and supporting artefacts.^{ISO/IEC 42001:2023NIST AI RMF 1.0}

For Veritas assessments, integrate the toolkit’s Jupyter notebooks or APIs into your evaluation pipelines. Capture results, including fairness metrics and recommended mitigations, and store them in the risk register. For AI Act conformity assessments, link to quality management documentation and supplier attestations. For OMB reporting, configure workflows that generate required forms and track submission deadlines.^{MAS Veritas Toolkit 2.0Regulation (EU) 2024/1689OMB M-24-10}

Monitoring and incident management

Deploy monitoring platforms capable of tracking model performance, data drift, bias metrics, and operational health. Configure alerts aligned with human oversight thresholds. Integrate monitoring with incident management tools so alerts automatically generate tickets with severity classification, incident commanders, and response timelines. Implement audit logging to show who acknowledged and resolved incidents.

For regulatory reporting, configure templates that compile incident details, mitigation steps, and lessons learned. Article 73 requires providers to cooperate with national competent authorities and supply information upon request. Maintain export functions that package logs, monitoring data, and remediation records for regulators. Align these exports with OMB’s seven- and thirty-day follow-up reports to reduce duplication.^{Regulation (EU) 2024/1689OMB M-24-10}

Documentation repositories

Store technical documentation, risk assessments, model cards, and transparency reports in a version-controlled repository with immutable audit trails. Use metadata tags to link documents to inventory entries, regulatory obligations, and control owners. Provide search capabilities for auditors to retrieve evidence quickly. Automate generation of conformance statements and quality management manuals from structured data in your inventory and risk tools.^{Regulation (EU) 2024/1689}

Implement retention policies that align with Article 11 (technical documentation) and Article 75 (post-market monitoring) requirements. Ensure documents remain accessible to regulators and customers even after systems are retired. Maintain change logs that describe why updates were made, who approved them, and which regulatory triggers prompted the change.^{Regulation (EU) 2024/1689}

Metrics

Metrics provide transparency to leadership, regulators, and customers. They should measure compliance coverage, risk reduction, and operational effectiveness. ISO/IEC 42001 Clause 9.1 emphasises monitoring and measurement, while NIST AI RMF’s Measure function requires quantitative and qualitative evaluation of risk management effectiveness.^{ISO/IEC 42001:2023NIST AI RMF 1.0}

Develop metric families aligned with stakeholder needs:

• Regulatory readiness. Track percentage of AI Act high-risk systems with completed Annex IV technical documentation, number of systems registered in the EU database, and conformity assessment status. Monitor OMB inventory submissions, risk assessment completion rates, and incident reporting compliance. Measure adoption of Veritas fairness assessments across Singapore-exposed systems.^{Regulation (EU) 2024/1689OMB M-24-10MAS Veritas Toolkit 2.0}
• Risk posture. Monitor distribution of risk scores by business unit, changes in risk ratings after mitigation, and residual risk trends. Track model performance stability, bias metrics (e.g., equal opportunity difference), and robustness scores. Measure incident frequency, mean time to detection, and mean time to containment.
• Control effectiveness. Evaluate completion rates for human oversight reviews, red-team exercises, and post-market monitoring activities. Track policy attestation coverage, training completion, and audit findings. Measure remediation cycle times for control deficiencies.
• Operational efficiency. Report the average time required to onboard a new AI system into the governance process, the proportion of automated versus manual assessments, and resource utilisation for governance teams.

Visualise metrics in dashboards tailored to each audience. Executive dashboards should highlight trends, upcoming regulatory deadlines, and areas requiring investment. Operational dashboards should provide drill-down capabilities for control owners. Regulator-facing reports should map metrics directly to statutory requirements (e.g., Article 9 risk management effectiveness).

Ensure data integrity. Automate data collection from inventories, monitoring platforms, and documentation repositories. Implement validation checks and audit trails. Provide narrative context alongside metrics to explain anomalies, corrective actions, and planned improvements. Update dashboards at least monthly, with quarterly deep dives to satisfy board oversight expectations and ISO/IEC 42001 management review requirements.

Future watchlist

Regulatory and standards landscapes are accelerating. Maintain a forward-looking watchlist to anticipate new obligations, coordinate policy engagement, and adjust control roadmaps.

• EU harmonised standards. Monitor CEN-CENELEC Technical Committees as they draft standards for AI quality management, data governance, and testing so you can claim presumption of conformity under Articles 40 and 41 once references are published.^{Regulation (EU) 2024/1689}
• European AI Office guidance. Track implementing acts and guidance issued by the European AI Office, which the AI Act tasks with coordinating enforcement and supporting consistent application of general-purpose AI obligations.^{Regulation (EU) 2024/1689}
• U.S. federal rulemaking. Follow agency-specific AI regulations that flow from Executive Order 14110 and OMB M-24-10 so procurement and risk workflows reflect emerging sector rules.^{Executive Order 14110OMB M-24-10}
• State and sector legislation. Monitor Colorado’s SB 24-205 and similar state initiatives that introduce duties for deployers of high-risk AI beginning in 2026, and align them with EU and federal controls to prevent fragmentation.^{Colorado SB 24-205}
• Singapore supervisory coordination. Review updates from the Veritas consortium and MAS consultations to ensure regional documentation keeps pace with sector guidance.^{MAS Veritas Initiative}
• International alignment. Incorporate emerging international standards such as ISO/IEC 23894 on AI risk management into your control framework as they become available to support cross-border assurance.^{ISO/IEC 23894:2023}

Leverage Zeph Tech’s daily briefings to stay current. Subscribe to updates via AI Act publication coverage, NIST AI RMF analysis, and enforcement timeline tracking. Align roadmap reviews with these insights so governance programs can anticipate rather than react.