EU AI Act, NIST AI RMF 1.0 & ISO/IEC 42001 Cross-Border Governance Audit
Follows the Chief Audit Executive and Global Privacy Counsel at EuroAtlantic Financial Group as they conduct a pre-enforcement readiness audit across 14 deployed AI models ahead of EU AI Act high-risk deadlines and ISO/IEC 42001 certification—uncovering an outlawed emotion-recognition call-center tool, unvalidated credit-scoring training bias, and non-compliant cross-border fine-tuning pipelines.
Extraterritorial Scope, Provider vs. Deployer Roles & Article 5 Prohibited AI Practices
The fluorescent hum of EuroAtlantic Financial Group's Global Audit Services war room felt particularly oppressive on October 26, 2024. Chief Audit Executive, Anya Sharma, stared at the preliminary AI inventory spreadsheet, 'EAFG_AI_Model_Register_v1.2.xlsx,' her gaze fixed on row 7: 'SentimentAnalyzer_v3.1 – Call Center Agent Performance.' Global Privacy Counsel, Dr. Kenji Tanaka, adjusted his glasses, a grim line forming on his lips. 'Anya, this is a red-file situation. The EU AI Act's Article 5 prohibitions are clear: emotion recognition in the workplace is outlawed. We're looking at potential fines up to EUR 35 million or 7% of global turnover, whichever is higher, if this system isn't immediately decommissioned.' The tool, deployed across EAFG's European call centers since Q1 2023, had processed over 1.2 million customer interactions, purportedly to 'enhance agent empathy training.' Their internal audit workpaper, 'WP-AI-001: Initial AI Model Scan,' flagged it as 'High Risk – Unclassified Regulatory Impact.' The clock was ticking; the EU AI Act's enforcement date loomed, and EAFG's reputation, along with its bottom line, hung precariously in the balance. This wasn't just a compliance exercise; it was an existential threat.