AI in use but no compliance framework disclosed

Compliance frameworks such as NIST AI RMF and ISO 42001 are recognised standards for managing AI responsibly. Disclosing which framework your business follows — typically on a trust, AI policy, or security page — signals to customers and business partners that your AI use is governed and auditable. Enterprise buyers and procurement teams increasingly require a disclosed AI compliance framework before approving AI vendors. The EU AI Act's transparency obligations for AI systems interacting with people took effect in August 2025, with obligations for high-risk AI systems applying from August 2026. Without a disclosed framework, deals can stall in legal review even if your product is excellent. Create a short /trust or /ai-policy page that names the framework you follow (or are working toward), describes what AI does in your product, and provides a contact for AI-related queries. Even a basic disclosure is better than silence.

Why this matters

Enterprise buyers and procurement teams increasingly require a disclosed AI compliance framework before approving AI vendors. The EU AI Act's transparency obligations for AI systems interacting with people took effect in August 2025, with obligations for high-risk AI systems applying from August 2026. Without a disclosed framework, deals can stall in legal review even if your product is excellent.

How to fix it

Create a short /trust or /ai-policy page that names the framework you follow (or are working toward), describes what AI does in your product, and provides a contact for AI-related queries. Even a basic disclosure is better than silence.