Question 1

How do I register an AI system in RegSeal?

Accepted Answer

After signing in, navigate to Systems in the sidebar and click "Register System." Provide your system's name, primary purpose, deployment regions, and whether it makes autonomous decisions. RegSeal will automatically classify the system against all applicable frameworks and generate your initial risk tier.

Question 2

How do I start a compliance assessment?

Accepted Answer

Go to Assessments and click "New Assessment." Select the AI system you want to evaluate and choose one or more frameworks (EU AI Act, Colorado AI Act, NIST AI RMF, ISO 42001). RegSeal walks you through each requirement, lets you attach evidence, and calculates a weighted compliance score as you progress.

Question 3

How is my compliance score calculated?

Accepted Answer

Each framework requirement is scored 0–100 based on whether you have addressed it and the quality of supporting evidence. The overall score is a weighted average, where critical requirements carry more weight. Scores also decay slightly over time to reflect evolving regulatory expectations, so re-confirming controls keeps your score current.

Question 4

What should I do first after signing up?

Accepted Answer

Start by registering your highest-risk AI system. RegSeal’s classification engine will determine its risk tier under each framework. From there, launch an assessment for the framework most relevant to your deployment geography. The guided workflow will tell you exactly what evidence and documentation you need.

Question 5

Which compliance frameworks does RegSeal cover?

Accepted Answer

RegSeal currently supports four core frameworks: the EU AI Act (including Annex IV technical documentation and all four risk tiers), the Colorado AI Act (with affirmative defense support), NIST AI RMF 1.0 (Govern/Map/Measure/Manage functions), and ISO/IEC 42001 (AI management system requirements). New regulations are added automatically as they emerge worldwide via our Nexara regulatory intelligence engine. Cross-framework mapping lets you reuse answers across overlapping requirements.

Question 6

Does the EU AI Act apply to companies outside the EU?

Accepted Answer

Yes. The EU AI Act has extraterritorial reach—it applies to any organization that places an AI system on the EU market or whose AI system’s output is used within the EU, regardless of where the company is headquartered. If your AI system serves EU users or customers, you likely fall within scope.

Question 7

What is the EU AI Act’s risk classification and how does RegSeal handle it?

Accepted Answer

The EU AI Act defines four risk tiers: Unacceptable (banned), High-Risk, Limited Risk, and Minimal Risk. RegSeal’s classification engine analyzes your system’s intended use, domain, and decision-making characteristics to assign the correct tier. High-Risk systems require Annex IV technical documentation, which RegSeal can auto-generate from your assessment data.

Question 8

What is the Colorado AI Act affirmative defense and how does RegSeal support it?

Accepted Answer

The Colorado AI Act allows developers and deployers of high-risk AI systems to assert an affirmative defense if they can demonstrate compliance with a recognized framework like NIST AI RMF. RegSeal tracks your NIST compliance posture and explicitly maps it to Colorado’s affirmative defense requirements, giving you documented evidence of your good-faith compliance efforts.

Question 9

Is NIST AI RMF mandatory or voluntary?

Accepted Answer

The NIST AI Risk Management Framework is voluntary for most organizations. However, it is increasingly referenced by regulators and procurement offices as a baseline standard. Compliance with NIST AI RMF also serves as the foundation for the Colorado AI Act’s affirmative defense, making it strategically valuable even where not legally required.

Question 10

What is the difference between ISO 42001 and ISO 27001?

Accepted Answer

ISO/IEC 42001 is the international standard for AI management systems—it covers responsible AI development, risk management, and governance specific to AI. ISO 27001 focuses on information security management. They are complementary: 42001 addresses AI-specific risks (bias, transparency, accountability) while 27001 covers data security controls. RegSeal assesses against 42001.

Frequently Asked Questions

Still need help?

Frequently Asked Questions

Still need help?