Every framework,
pre-mapped to controls.
Answer once, comply many times. Fixco cross-maps a single control set to every regime below, so evidence you collect for one framework counts toward the others.
| Regime | Who it hits | Key date | Max penalty | Status |
|---|---|---|---|---|
| EU AI Act — most obligations | Transparency (Art. 50), governance & enforcement across the EU | 2 Aug 2026 | Up to €35M / 7% turnover | Aug 2026 |
| EU AI Act — high-risk (Annex III) | Providers & deployers of Annex III systems in the EU | 2 Dec 2027 | Up to €15M / 3% turnover | Deferred |
| Colorado AI Act (SB 24-205 → SB 26-189) | Deployers of automated decisions on CO residents | 1 Jan 2027 | State consumer-protection enforcement | Jan 2027 |
| NYC Local Law 144 | Employers using automated hiring tools in NYC | Annual bias audit | $500–$1,500/violation/day | In force |
| Texas TRAIGA | AI developers & deployers doing business in TX | 1 Jan 2026 | Up to $200K/violation | In force |
| ISO/IEC 42001 | Any org seeking certifiable AI management | Voluntary | — (certification) | Certifiable |
| NIST AI RMF | US federal supply chain & best practice | Voluntary | — (procurement) | Mapped |
Dates reflect Fixco's Regulation Radar as of July 2026. The EU's 2026 Digital Omnibus deferred high-risk (Annex III) duties to 2 Dec 2027, while most of the AI Act still applies from 2 Aug 2026; Colorado's SB 24-205 was replaced by SB 26-189 (effective 1 Jan 2027). Your registry re-scores automatically when rules move like this.
Log-ish scale, or the last bar would be invisible. Which is rather the point.
Pick your regime.
The world's first comprehensive AI law — with extraterritorial reach
If your system's output is used in the EU, you're in scope even from Austin or Singapore. Fixco classifies each system into prohibited / high-risk / limited / minimal tiers with Annex III citations, drafts your technical documentation and oversight procedures, and assembles the Art. 11 technical file as a one-click export.
Who needs it now
Hiring, credit, insurance, education, biometrics, and medical AI — plus every company deploying such systems, not just building them.
Key dates
Most of the Act — transparency, governance, enforcement — applies from 2 August 2026. High-risk (Annex III) duties were deferred to 2 December 2027 by the 2026 Digital Omnibus. Penalties: up to €35M / 7% for prohibited uses, up to €15M / 3% for high-risk breaches.
Voluntary on paper, mandatory in practice
The lingua franca of US enterprise procurement. Fixco maps your registry to the four functions — Govern, Map, Measure, Manage — scores coverage per system, and turns completed work into a shareable RMF profile for RFPs.
Who needs it now
Anyone selling AI-touched software to US enterprises or government — an RMF profile is increasingly the first attachment in a security review.
The Fixco edge
Evidence collected here cross-counts toward the EU AI Act and ISO 42001 automatically. Answer once, comply many times.
The first certifiable AI standard
Like ISO 27001 for security, a 42001 certificate ends AI due-diligence conversations. Fixco operates your AI management system day-to-day: clause-mapped controls, management review packs, internal audit scheduling, and a certification-ready Statement of Applicability generated from live data.
Who needs it now
Companies whose enterprise customers ask "are you 42001 certified?"
Typical timeline
Our ISO 42001 fast-track is built around a realistic nine-week path from first scan to certification readiness.
State AI laws are where enforcement starts
Enterprise suites govern ML pipelines; most skip the state-law paperwork entirely. Fixco generates the specific artifacts each statute demands.
Colorado (SB 26-189)
The 2024 duty-of-care law (SB 24-205) was replaced in 2026 by a disclosure-and-transparency regime for automated decisions, effective 1 Jan 2027. Fixco drafts the required consumer notices and keeps the three-year records.
NYC LL144
AEDT inventory, annual bias-audit coordination, candidate notices, and the public summary page — templated and scheduled so nothing lapses.
Texas TRAIGA
Screens systems against prohibited practices and keeps the records that support safe-harbor arguments.
Everything else
Regulation Radar tracks emerging state bills and re-scores your registry the day they pass.
Not sure which regimes apply to you?
The free readiness check tells you in two minutes — with citations.
Run the readiness check