Designing One Control Set That Satisfies Several States

When managing AI systems across multiple US states such as Colorado and California, compliance teams often face the challenge of aligning diverse regulatory frameworks. Designing one control set that satisfies several states’ requirements is not only practical but also cost-effective. This approach allows organisations to reduce duplication, streamline governance, and maintain consistency in their AI risk management strategies. The key lies in identifying overlapping or complementary elements across state laws, and then building controls that meet the broadest or most stringent standards.

Understanding Overlapping Requirements

Colorado’s AI bill, HB 1174, and California’s AI bill, AB 2304, both focus on transparency, fairness, and accountability. While they differ in scope and enforcement, they share similar foundational principles. For example, both laws require organisations to assess AI systems for bias and ensure they do not cause harm. These shared elements allow compliance teams to develop one set of controls that addresses both statutes. The focus should be on creating frameworks that meet the lowest common denominator of these laws, while exceeding the requirements where necessary to ensure broader protection.

• Ensure AI systems undergo bias testing before deployment
• Document decision-making processes for high-risk AI applications
• Train staff on AI-related risks and responsibilities

Designing Controls That Meet EU AI Act Standards

Organisations operating in both US states and EU markets must also consider the EU AI Act, which applies to AI systems placed on the EU market or used within the EU. The Act introduces classifications such as prohibited, high-risk, and general purpose AI systems. The EU AI Act’s Article 5, which prohibits certain AI practices, became enforceable on 2 February 2025. The obligation to provide AI literacy training also started on that date, with national supervision from 2 August 2026. These obligations must be incorporated into US state compliance frameworks to ensure global readiness.

For example, a US-based company using AI models in both California and EU markets must ensure that its AI governance framework includes:

• Prohibiting AI systems that manipulate human behaviour or exploit vulnerabilities
• Providing AI literacy training to staff
• Implementing risk management processes aligned with EU classifications

This alignment helps reduce the burden of maintaining separate frameworks for US and EU compliance. The EU AI Act’s Article 50 transparency duties, which apply from 2 August 2026, also require machine-readable marking of generative AI systems. Companies must plan for these obligations early, especially if they have systems placed on the market before that date.

ISO Standards and Certification Readiness

ISO/IEC 42001:2023 provides a framework for implementing an AI management system. The standard is designed to support organisations in establishing, implementing, maintaining, and continually improving an AI governance framework. The first UKAS-accredited certification body, BSI, became operational on 15 January 2026. Companies that adopt this standard early can benefit from formal recognition of their AI governance efforts. The standard’s clause-based approach allows compliance teams to map existing controls to required elements, reducing the effort needed to meet regulatory expectations.

Organisations should begin by identifying which AI systems fall under the scope of ISO/IEC 42001. Then, they must develop controls that align with the standard’s requirements, such as:

• Establishing AI governance roles and responsibilities
• Defining AI risk assessment processes
• Creating documentation for AI system design and deployment

By integrating these controls into a single framework, firms can satisfy US state laws, EU AI Act obligations, and international standards. This unified approach makes it easier to demonstrate compliance during audits or regulatory investigations. The goal is to build a control set that is flexible enough to accommodate evolving laws, yet dependable enough to meet current obligations. Regular reviews of these controls ensure they stay aligned with changing regulatory expectations, including future updates to EU AI Act classifications or US state legislation.