What is system-centric compliance?
System-centric compliance organises governance around the AI system rather than around individual regulations. Instead of asking "what does the AI Act require?" and then separately "what does GDPR require?" and then "what does NIS2 require?", system-centric compliance asks: "what does this specific AI system need to be governed for across all applicable regulations?"
The system is the anchor. The regulations are mapped to it. One system, one governance record, all applicable obligations.
Key points
- The AI system is the primary entity. Regulations, obligations, evidence, and approvals are attributes of the system record — not separate compliance workstreams.
- System-centric compliance prevents regulatory silos. The AI Act team, the GDPR team, and the NIS2 team all work on the same system record.
- Each system's governance record shows its full regulatory context: which frameworks apply, which obligations are mapped, what evidence exists, and what gaps remain — across all regulations simultaneously.
- This approach scales. With hundreds of AI systems, regulation-centric compliance creates thousands of disconnected records. System-centric compliance creates one governed record per system.
Why it matters
Most organisations start compliance regulation-by-regulation: first GDPR, then AI Act, then NIS2. Each creates its own inventory, its own risk assessments, its own evidence structure. The result is three views of the same reality, maintained in parallel, with no connection between them. System-centric compliance eliminates this by making the system the organising principle — which is how auditors and regulators will ultimately examine it anyway.
How EAB approaches this
EAB's AI System Registry is the system-centric anchor. Each system has one governance record that spans AI Act, GDPR, and NIS2 obligations. The Obligation Matrix maps cross-regulatory requirements. Evidence reuse connects shared artefacts across frameworks.