7 Layers of AI Compliance: NIST AI RMF, ISO 42001 & SOC 2

Why AI Compliance Needs Seven Layers

AI compliance is not a single framework. It is the intersection of laws, standards, security testing, and continuous evidence. No single framework covers everything. The seven layers below provide a complete picture of what it takes to secure and govern AI in production.

Layer 1: Legal & Regulatory

The foundation. This layer maps the laws and regulations that apply to your AI systems: EU AI Act, GDPR, HIPAA, TCPA, TRAIGA, NYC Local Law 144, and sector-specific rules. The output is an applicability assessment — which laws apply to which systems, and what each law requires.

Layer 2: Frameworks & Standards

NIST AI RMF provides the governance structure. ISO 42001 provides the management system. SOC 2 provides the controls audit. These frameworks are complementary, not competing. NIST tells you what to do. ISO tells you how to manage it. SOC 2 tells you whether your controls are working.

Layer 3: Security Testing

OWASP GenAI security risks, MITRE ATLAS adversarial testing, CSA AI Controls Matrix. This layer is about finding vulnerabilities before they are exploited. AI systems have unique attack surfaces — prompt injection, RAG poisoning, model extraction, training data inference — that traditional security testing does not cover.

Layer 4: Architecture & Infrastructure

How your AI systems are built. This layer covers model selection, data pipelines, deployment infrastructure, integration patterns, and the architecture decisions that determine whether your system is secure by design or secure by accident.

Layer 5: Operations & Monitoring

Drift detection, performance monitoring, incident response, and continuous improvement. AI systems degrade over time — models drift, data changes, concepts evolve. Without monitoring, you are flying blind. This layer is where HAIEC's Precision Drift Detection and Compliance Engine operate.

Layer 6: Evidence & Audit

Continuous evidence collection, audit trail generation, compliance reporting, and evidence retention. When an auditor asks "prove you're compliant," this layer provides the answer. It is not enough to be compliant — you must be able to demonstrate it on demand.

Layer 7: Governance & Culture

AI governance committees, ethical review boards, stakeholder management, and organizational culture. This is the layer that makes everything else work. Without executive sponsorship and a culture of compliance, the other six layers become documentation exercises.

How the Layers Work Together

The layers are not sequential — they are concurrent. A change in Layer 1 (new regulation) triggers changes in Layers 2-6. A security incident in Layer 3 requires evidence from Layer 6 and governance response from Layer 7. The seven layers form a continuous loop, not a pipeline.

Common Gaps

• Framework without testing: Organizations adopt NIST AI RMF but never run adversarial tests. The framework is documentation without verification.
• Testing without evidence: Security teams run penetration tests but don't connect results to compliance reporting. The testing effort is wasted from an audit perspective.
• Evidence without governance: Audit trails exist but nobody reviews them. Compliance becomes a checkbox exercise rather than a feedback loop.

Getting Started

Start with Layer 1: know which laws apply to your AI systems. Then work through the layers in parallel, not sequentially. The HAIEC platform and CSM methodology were designed to operationalize all seven layers within a single system.

Read the full guide →