What the regulatory frameworks have in common
Disclaimer: The following is a general overview for informational purposes only and doesn’t constitute legal advice. Be sure to consult legal counsel before drawing compliance conclusions for your use case.
Most organizations governing AI are navigating more than one framework at once. This includes:
- The EU AI Act, which classifies AI use in specific categories as high-risk such as: HR recruitment, education, critical infrastructure, and law enforcement. Tools in these categories require logging, human oversight, and documented risk controls.
- DORA and NIS2 impose digital resilience requirements if you operate in EU markets. This may cover AI-enabled SaaS dependencies in finance, infrastructure, and core business operations.
- NIST AI RMF and ISO/IEC 42001 are often relevant in enterprise and government procurement. If you can’t document your AI tool footprint or show governance controls, you may face challenges in complying with contract obligations that reference them.
- GDPR vendor reviews typically emphasize technical controls. However, guidance from the EDPB and CNIL highlights the need to assess how AI systems process personal data during training, which feeds into the due diligence they must perform on AI providers under Article 28.
These frameworks address different risks, but they share the same operational requirement: an inventory of AI usage, monitored access, and evidence that controls are working effectively. To do all of this, visibility is key.
While many organizations still lack one or more of these foundational capabilities, the LastPass 2026 State of AI and SaaS Security Report reveals what you should prioritize if you want to narrow the “policy versus proof” gap.
A visibility-first sequence for compliance readiness
What do auditors need to see?
Auditors typically look for AI inventories, risk assessments, access controls, and monitoring records that indicate that policies are being enforced.
Every regulatory framework requires the same starting point: A live picture of what's running before you try to apply controls.
See it: Establish a continuous view of every AI and SaaS tool employees are authenticating to, including tools accessed via personal accounts.
- LastPass Business Max builds the live inventory the "See it" step requires, surfacing SaaS and AI tools employees log in to via the LastPass browser extension.
Assess it: Map the inventory against the regulatory frameworks that apply to your organization. Start with the highest-risk categories and then expand from there; each tool that’s assessed and documented becomes part of the evidence base.
Govern it: Apply access controls based on each tool’s risk tier.
- Using LastPass, admins can apply per-app rules at the point of access, producing the enforcement log the "Govern it" step requires.
What a compliance-ready AI posture looks like
Organizations with continuous AI monitoring are better positioned to respond effectively to audits and regulatory assessments.
With discovery and governance in place through LastPass, you can:
- Know your high-risk exposure before the auditor does.
- Close enterprise deals faster. Procurement teams asking for active monitoring documentation get records, not a policy PDF.
Note: LastPass provides access-layer visibility and enforcement logs that regulatory frameworks consistently require. As with any technical compliance solution, the specific requirements that apply to your organization will depend on your industry, location, and use cases. Qualified legal counsel can help you assess those.
Get the full AI governance compliance data
The LastPass 2026 State of AI and SaaS Security Report documents AI adoption rates, governance gaps, and SaaS sprawl findings across real organizations. Insights are based on survey responses from 412 IT leaders, login habits from 450,784 users across 20,631 organizations, and app usage at 15,907 organizations.
