LexLint.ioBeta

Know the law your code answers to.

The sixteen AAIF themes, filled from binding law

About this documentUpdated ShowHide

Sean McDermott, Co-Founder and CEO, UnGovr

Written by Sean McDermott (with AI assistance) using the LexLint law library, which supplied every legal instrument, status and date on these pages.

Every law named here links to its summary page on lexlint.io, translated to English (if needed) and restructured to a standard format for human and code use. Every case links to the court's or the regulator's own record where one could be reached.

© 2026 UnGovr, publishing as LexLint. The text and the figures are licensed under Creative Commons Attribution-ShareAlike 4.0: share and adapt them, including commercially, with credit to LexLint (UnGovr) and under the same license. Please contact LexLint at hello@ungovr.org to discuss other terms. Logos and wordmarks belong to their owners.

Law library as of .

Legal information, not legal advice. This document describes the law as written and dated; it does not apply it to any system. The notice in the footer says what that means.

Each of the working group's sixteen themes with its key concepts, what the LexLint law library holds under it, and a sample of the requirement lines in force, drawn to span jurisdictions. A sample of the register in the group's own column contract is the file in section 3.

1How to read a theme

The sixteen themes are the Agentic AI Foundation governance working group's. The group published them, with a short description of each, in its August 2026 report; the key concepts quoted under each theme here come from the group's extraction workbook, which is not public, and are summarized in the group's own words. Where the themes come from, and how the LexLint law library's twenty obligation classes map onto them, is the page before this one. Here each theme is filled from binding law: 15,417 requirement lines drawn from the law library on , of which 13,724 belong to an instrument in force on that date. A line joins a theme when its instrument's obligation class is one the theme's prompt is about, or when the line's own wording matches the theme's key concepts. A line can sit in more than one theme, as the group's own prompts allow. The rules are deliberately generous, so a theme's count is an upper bound on what a careful reader would keep, and the thin themes are thin because the law says little there, not because the rule missed it.

Each theme quotes the group's key concepts, gives its counts, and holds a sample of up to fourteen lines in force, drawn to span jurisdictions rather than to rank them, folded away until opened. The requirement is stated first, as the law library records it; under it, the facts the group's columns ask for (type, modal language, applicable entity) and the three the law library adds (the party whose position triggers scope, the territorial hook, and what a runtime control can do about it), then the jurisdiction, the instrument and its date, and the line identifier. How each of those facts is derived is set out in the requirement register, which is the same lines on the law library's own axes. A sample of the register in the group's column contract, the lines of European Union law, is the file in section 3.

ThemeLinesIn forceInstrumentsJurisdictionsWhere the lines come from
T01 Governance & Accountability 1,104 998 746 216 cybersecurity 588 · privacy 354 · AI 154 · scraping 8
T02 Use-case Classification & Risk Tiering 2,798 2,365 949 245 privacy 1,479 · AI 1,000 · scraping 160 · cybersecurity 159
T03 Architecture 82 70 75 56 privacy 39 · cybersecurity 24 · AI 17 · scraping 2
T04 Agent Identity & Delegation 633 591 515 192 privacy 295 · cybersecurity 199 · AI 93 · scraping 46
T05 Guardrails & Policy Constraints 781 720 601 222 privacy 462 · cybersecurity 170 · AI 106 · scraping 43
T06 Data Protection & Privacy 6,211 5,543 2,314 271 privacy 5,134 · AI 472 · cybersecurity 398 · scraping 207
T07 Security & Access Controls 6,704 6,310 1,755 270 cybersecurity 3,736 · privacy 2,077 · scraping 736 · AI 155
T08 Model/Agent Risk Management 1,661 1,375 851 234 privacy 660 · cybersecurity 531 · AI 444 · scraping 26
T09 Human Oversight 355 269 291 140 privacy 159 · AI 105 · cybersecurity 68 · scraping 23
T10 Action Management 213 186 195 107 privacy 93 · scraping 56 · AI 40 · cybersecurity 24
T11 Monitoring & Logging 702 606 514 191 cybersecurity 306 · privacy 241 · AI 144 · scraping 11
T12 Testing & Red Teaming 149 142 136 83 cybersecurity 115 · privacy 21 · AI 13
T13 Third-Party & Supply Chain 2,916 2,644 1,512 264 privacy 1,507 · cybersecurity 823 · scraping 299 · AI 287
T14 Incident Response 2,585 2,376 1,102 244 cybersecurity 1,421 · privacy 1,041 · AI 92 · scraping 31
T15 Transparency & User Disclosure 7,182 6,354 2,613 266 privacy 3,770 · cybersecurity 1,942 · AI 1,185 · scraping 285
T16 Recordkeeping & Auditability 7,814 6,981 1,989 269 cybersecurity 3,651 · privacy 2,828 · AI 1,076 · scraping 259

2The sixteen AAIF themes

T01 · Governance & Accountability

The group's key concepts: Ownership; approvals; RACI; risk acceptance; governance bodies; accountability structures

1,104 lines 998 in force 746 provisions 216 jurisdictions by type: mandatory obligation 638, conditional obligation 345, prohibition 51, definition 35, recommendation/guidance 22, consequence (penalty or remedy) 8, permission or exemption 5

Classes its lines carry: secure the system and the data in it (623), govern the system: policies, roles, assessments (589), report to a regulator (236), disclose the use of AI (215); 74 from an instrument with no class recorded.

Sample requirement lines Show 13 of the 998 lines in forceHide the sample

What follows is a sample of 13 requirement lines from the LexLint law library, chosen to span jurisdictions.

European Union

Have robust governance arrangements, which include a clear organizational structure with well-defined, transparent and consistent lines of responsibility (Article 74(1), point (a)).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Capital Requirements Directive, Robust Governance Arrangements of Institutions (Article 74(1)), Directive 2013/36/EU, Article 74(1) Source as of ai:eu-2013-36-eu-74-1:2

California

Be ready to attest to and explain your policies and safeguards against the exploitation or distribution of illegal content such as child sexual abuse material and non-consensual intimate imagery, against the use of models that display harmful bias, and your governance to reduce the risk of such bias (Paragraph 1, points a and b).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
California Executive Order N-5-26 (vendor certifications, supply chain review and contractor responsibility in state AI procurement), Cal. Exec. Order N-5-26 () Source as of ai:us-ca-cal-exec-order-n-5-26-mar-30-2026:2

Colorado

Establish a documented, risk-based governance and risk management framework, including a cross-functional governance group drawing on legal, compliance, risk management, product development, underwriting, actuarial, data science, marketing, and customer service, designed to determine through quantitative testing whether your use of an external consumer data and information source, or an algorithm or predictive model that uses one, results in unfair discrimination with respect to race, and to remediate any discrimination detected.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, 3 CCR 702-10, Regulation 10-1-1 Source as of ai:us-co-3-ccr-702-10-10-1-1:0

Texas

You must provide an easily accessible system for a depicted person to request removal, and a clear, plain-language notice describing that process and your responsibilities under it.
Type Mandatory Obligation Modal must Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Outside any runtime path
S.B. 441 (2025), civil liability for artificial intimate visual material and nudification applications, Tex. Civ. Prac. & Rem. Code §§ 98B.0021-98B.009 Source as of ai:us-tx-tex-civ-prac-rem-98b-0021-98b-009:3

United Kingdom

It reaches you if you are a firm that makes a personal recommendation to a retail client in relation to a designated investment, manages investments of a retail client of the firm, or manages the assets of an occupational pension scheme, stakeholder pension scheme or personal pension scheme, other than in relation to your MiFID, equivalent third country or optional exemption business or an insurance-based investment product, for which COBS 9A sets the suitability rules (COBS 9.1.1R and COBS 9.1.1AG), and not in relation to a targeted support service within the scope of COBS 9B (COBS 9.1.1BG): take reasonable steps to ensure that a personal recommendation, or a decision to trade, is suitable for your client, and ensure that any life policy proposed is consistent with the client's insurance demands and needs (COBS 9.2.1R(1)).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Suitability for business that is not MiFID business: personal recommendations to retail clients and decisions to trade for them (COBS 9.1 and 9.2), FCA Handbook, COBS 9 Source as of ai:gb-fca-handbook-cobs-9:0

Brazil

Appoint a data protection officer by a formal written, dated and signed act that states how the officer acts and what the officer does, and give the act to the ANPD when it asks.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject; establishment of the operator Runtime not yet classified
ANPD Regulation on the Data Protection Officer (Resolution CD/ANPD No. 18/2024), Resolução CD/ANPD nº 18, de 16 de julho de 2024 (Regulamento sobre a atuação do encarregado pelo tratamento de dados pessoais), Anexo, arts. 3º, 5º, 8º-10 and 19-21 Source as of privacy:br-resolucao-cd-anpd-no-18-de-16-de-julho-de-202:0

India

An app processing Indian personal data, including biometric identifiers, answers only to the Data Protection Board of India: the civil courts have no jurisdiction over a matter the Board is empowered to decide, and the Act arms no private plaintiff.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Establishment of the operator Runtime reworded since it was classified
Digital Personal Data Protection Act, 2023, Data Protection Board and penalties, Digital Personal Data Protection Act, 2023 (DPDPA), Data Protection Board and penalties, ss.18-26, 33, 39 Source as of privacy:in-digital-personal-data-protection-2023-dpdpa-d:0

Vietnam

During an inspection or examination of your AI activity in Vietnam, provide the inspecting authority with technical dossiers, trace logs, training data and other necessary information needed to determine the cause of a violation or incident or to apportion responsibility.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Law on Artificial Intelligence, inspection and examination, Law No. 134/2025/QH15, art. 28 Source as of ai:vn-no-134-2025-qh15-28:0

Germany

Cover at least: risk analysis and information-security policy; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security; security in the acquisition, development and maintenance of your systems, including vulnerability management and disclosure; evaluation of your measures' effectiveness; basic cyber-hygiene training; cryptography; personnel security and access control; and multi-factor or continuous authentication.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Operator Hook Establishment of the operator (entity in scope) Runtime Outside any runtime path
BSI-Gesetz (BSIG), Risk-Management Measures for Essential and Important Entities, BSI-Gesetz (BSIG) vom 2. Dezember 2025, as last amended by Article 8 of the Act of (BGBl. 2026 I Nr. 318), §§ 28, 30, 38 Source as of security:de-bsi-gesetz-bsig-vom-2-dezember-2025-28-30-38:2

Italy

If your AI service can be accessed by a minor under fourteen, obtain the consent of whoever holds parental responsibility before processing their personal data; a minor between fourteen and eighteen may consent alone if the required information is easily accessible and understandable (art. 4).
Type Conditional Obligation Modal may Binds, by its wording Operator (the party running the application) Scope turns on Principal Hook Establishment of the operator; placing on the market; where the output is used Runtime Enforceable at a runtime control
Legge 132/2025, Sector Human-Oversight and Disclosure Duties (Artt. 4, 11, 13), Legge 23 settembre 2025, n. 132, artt. 4, 11, 13 Source as of ai:it-l-132-2025-sector-oversight-disclosure:0

Spain

Public administrations will favour mechanisms so that the algorithms they use in decision-making take account of criteria of bias minimisation, transparency and accountability, wherever technically feasible; the mechanisms cover the algorithm's design and training data and its potential discriminatory impact, and impact assessments to determine possible discriminatory bias are to be promoted (Ley 15/2022, article 23(1)).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Ley 15/2022 Article 23, Artificial Intelligence and Automated Decision-Making Mechanisms in Public Administrations, Ley 15/2022, de 12 de julio, integral para la igualdad de trato y la no discriminación, art. 23 (BOE-A-2022-11589) Source as of ai:es-ley-15-2022-de-12-de-julio-integral-para-la-2:0

France

Where you are instead designated as an operator of essential services, apply the security rules the Premier ministre sets under Article 6 at your own expense, covering governance, protection, defence and resilience of your networks and systems.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Operator Hook Establishment of the operator (entity in scope) Runtime Outside any runtime path
Loi n° 2018-133 du 26 février 2018 (transposition NIS1), Security Requirements, Loi n° 2018-133 du 26 février 2018, Titre Ier, Chapitres II et III, art. 5, 6, 10, 11 et 12 Source as of security:fr-loi-n-2018-133-du-26-f-vrier-2018-titre-ier-c:3

Netherlands

Record a supply-chain security policy and check periodically that your direct suppliers and service providers meet your security requirements (Article 10).
Type Mandatory Obligation Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not yet classified Hook Establishment of the operator (entity in scope) Runtime not yet classified
Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Cyberbeveiligingsbesluit (Besluit van 8 juli 2026), Artt. 2, 4-13 en 24-25 Source as of security:nl-cyberbeveiligingsbesluit-besluit-van-8-juli-2:2

985 more lines in force under this theme, and 1,104 lines in all, are in the LexLint law library, each on the summary page of its instrument.

T02 · Use-case Classification & Risk Tiering

The group's key concepts: Allowed/prohibited uses; risk tiers; tiered controls; autonomy levels; classification criteria; re-classification triggers

2,798 lines 2,365 in force 949 provisions 245 jurisdictions by type: prohibition 993, conditional obligation 892, mandatory obligation 665, definition 94, consequence (penalty or remedy) 78, permission or exemption 62, recommendation/guidance 14

Classes its lines carry: do not do the named thing (2,327), get consent first (927), disclose the use of AI (575), secure the system and the data in it (467); 83 from an instrument with no class recorded.

Sample requirement lines Show 13 of the 2,365 lines in forceHide the sample

What follows is a sample of 13 requirement lines from the LexLint law library, chosen to span jurisdictions.

European Union

If you provide direct electronic access to a trading venue, have in place effective systems and controls that ensure a proper assessment and review of the suitability of clients using the service, that those clients are prevented from exceeding appropriate pre-set trading and credit thresholds, that their trading is properly monitored, and that appropriate risk controls prevent trading that may create risks to you or contribute to a disorderly market; direct electronic access without such controls is prohibited (Directive 2014/65/EU, Article 17(5)). Apply the controls of Articles 13, 15 and 17 and the real-time monitoring of Article 16 of Delegated Regulation (EU) 2017/589 to the order flow of each of your direct electronic access clients, conduct a due diligence assessment of prospective clients, and review your due diligence assessment processes and reassess your clients' systems and controls annually (Articles 20, 22 and 23).
Type Prohibition Modal may Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), Directive 2014/65/EU, Article 17, supplemented by Commission Delegated Regulation (EU) 2017/589 Source as of ai:eu-2014-65-eu-17-supplemented-by-commission-dele:18

California

Do not use a term, letter or phrase in the advertising or functionality of your AI or generative AI system, program, device or similar technology that indicates or implies that the care, advice, reports or assessments it offers are provided by a natural person who holds the appropriate license or certificate to practice as a health care professional (Section 4999.9(c)).
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Health Care Professional Title Protection for Artificial Intelligence Act (AB 489), Cal. Bus. and Prof. Code Sections 4999.8 and 4999.9 Source as of ai:us-ca-cal-bus-prof-sections-4999-8-4999-9:0

Colorado

Do not allow an AI system to interact with a client in any form of therapeutic communication unless the regulated professional, the AI system and the client interact synchronously in real time, and do not let it generate therapeutic recommendations or treatment plans without the professional's review and approval
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
HB 26-1195 (2026), Psychotherapy Artificial Intelligence Restrictions, Colo. HB 26-1195, 2026 Colo. Sess. Laws ch. 358 Source as of ai:us-co-colo-hb-26-1195-2026-colo-sess-laws-ch-358:0

Texas

Do not develop or deploy an AI system that intentionally aims to incite or encourage physical self-harm, harm to another person, or criminal activity.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
TRAIGA (H.B. 149, 2025), prohibited AI practices binding any person, Tex. Bus. & Com. Code §§ 552.052, 552.055-552.057 Source as of ai:us-tx-tex-bus-com-552-052-552-055-552-057:0

South Korea

Before you provide an AI system, or a product or service that uses one, review whether it is high-impact, meaning it may seriously affect a person's life, physical safety or fundamental rights and is used in energy supply, drinking water production, healthcare provision, medical and digital medical devices, nuclear material and facility safety, biometric identification for criminal investigation or arrest, hiring and loan decisions, transportation systems, public-service eligibility and fee decisions, and student assessment in early childhood, elementary and secondary education. You may ask the Ministry of Science and ICT to confirm your answer.
Type Mandatory Obligation Modal may Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
AI Framework Act, Article 34 (business-operator duties for high-impact AI), Act No. 20676, Article 34 Source as of ai:kr-no-20676-34:0

United Kingdom

Do not make or adapt a thing, or supply or offer to supply a thing, for use as a generator of purported intimate images, meaning a thing for creating, or facilitating the creation of, purported intimate images of a person.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Making or Supplying a Generator of Purported Intimate Images, Crime and Policing Act 2026, c. 20, s. 99, inserting ss. 66I-66L into the Sexual Offences Act 2003 Source as of ai:gb-crime-policing-2026-c-20-s-99-inserting-ss-66:0

Brazil

Do not use fabricated or manipulated content in electoral advertising to spread notoriously untrue or gravely decontextualized facts capable of harming the balance of the election or the integrity of the electoral process.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
TSE Resolution, Prohibition on Electoral Deepfakes, Resolução TSE nº 23.610/2019, art. 9º-C (redação dada pela Resolução TSE nº 23.732, de 27 de fevereiro de 2024) Source as of ai:br-resolu-o-tse-n-23-610-2019-9-c-reda-o-dada-pe:0

India

Inform your users that directing or causing your computer resource to produce or spread such prohibited information may attract penalty or punishment under law, and may lead to removal of the information, suspension or termination of the user's account without vitiating the evidence, and disclosure of the user's identity to a victim who complains.
Type Mandatory Obligation Modal may Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Where the output is used; placing on the market Runtime not yet classified
Synthetically Generated Information Labelling Duty for Intermediaries, Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, rule 3(3), as inserted by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (G.S.R. 120(E), dated ) Source as of ai:in-information-technology-intermediary-guideline:3

Vietnam

Classify your AI system's risk level (high, medium or low) before putting it into use, and answer for the accuracy of the result.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Decree implementing the AI Law, risk classification, notification, conformity assessment and risk management, Decree No. 142/2026/ND-CP, arts. 6, 9, 11-15 Source as of ai:vn-decree-no-142-2026-nd-cp-6-9-11-15:0

Germany

Provide the information or documentation, and give the access, that Article 21 requires of a provider of a high-risk AI system when a competent authority asks; carry out and update the fundamental rights impact assessment Article 27 requires and send the notification it requires; if you are a notified body, inform the notifying authority as Article 45 requires; and, if you operate a high-risk AI system under point 1, 3, 4 or 5 of Annex III, give an affected person the explanation Article 86 requires (Section 15).
Type Conditional Obligation Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on reworded since it was classified Hook Establishment of the operator; placing on the market; where the output is used Runtime reworded since it was classified
Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-Marktüberwachungs-und-Innovationsförderungs-Gesetz, KI-MIG), §§ 2, 6, 8, 13, 15, 16, 20 Source as of ai:de-gesetz-zur-markt-berwachung-und-innovationsf:0

Ireland

Do not distribute, publish or threaten to distribute or publish an intimate image of another person without that person's consent, with intent to cause harm or being reckless as to whether harm is caused, including an image that only purports to be that person's intimate depiction, such as an AI-generated or digitally altered synthetic image (s. 2).
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
Harassment, Harmful Communications and Related Offences Act 2020, Intimate Image Offences, Harassment, Harmful Communications and Related Offences Act 2020 (No. 32 of 2020), ss. 1-3 Source as of ai:ie-harassment-harmful-communications-2020-ss-2-3:0

Italy

Adopt the technical safety measures provided for the design, training, production and placing on the market of high-risk AI systems, suited to prevent malfunctions or alterations of how the systems work, and adopt human-oversight measures, where omitting them would endanger life or public or individual safety, or the security of the State (Codice Penale art. 437-bis, first paragraph).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Codice Penale, art. 437-bis, inserted by D.Lgs. 9 settembre 2026, n. 160, art. 12 Source as of ai:it-codice-penale-437-bis-inserted-by-d-lgs-9-set:0

Spain

Notify the AEPD without undue delay and, where feasible, within 72 hours of becoming aware of a personal-data breach affecting a person in Spain, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the affected person Runtime reworded since it was classified
GDPR Articles 33-34 and LOPDGDD Articles 73(r)-(s) and 74(m)-(n), Breach Notification, Regulation (EU) 2016/679, Arts. 33-34; LOPDGDD, Art. 73(r)-(s), Art. 74(m)-(n) Source as of privacy:es-eu-2016-679-33-34-lopdgdd-69-73-r-s:0

2,352 more lines in force under this theme, and 2,798 lines in all, are in the LexLint law library, each on the summary page of its instrument.

T03 · Architecture

The group's key concepts: Reference patterns; trust boundaries; control placement; multi-agent topology; isolation; separation of concerns

82 lines 70 in force 75 provisions 56 jurisdictions by type: mandatory obligation 39, conditional obligation 25, prohibition 12, definition 2, recommendation/guidance 2, consequence (penalty or remedy) 2

Classes its lines carry: govern the system: policies, roles, assessments (41), secure the system and the data in it (39), get consent first (24), assess the impact on personal data first (18); 13 from an instrument with no class recorded.

Sample requirement lines Show 14 of the 70 lines in forceHide the sample

What follows is a sample of 14 requirement lines from the LexLint law library, chosen to span jurisdictions.

European Union

Establish and monitor your trading systems and trading algorithms through a clear and formalized governance arrangement that sets out clear lines of accountability, including procedures to approve the development, deployment and subsequent updates of trading algorithms and to solve problems identified when monitoring them, effective procedures for the communication of information within the firm, and a separation of tasks and responsibilities of trading desks on the one hand and supporting functions, including risk control and compliance, on the other (Delegated Regulation (EU) 2017/589, Article 1).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), Directive 2014/65/EU, Article 17, supplemented by Commission Delegated Regulation (EU) 2017/589 Source as of ai:eu-2014-65-eu-17-supplemented-by-commission-dele:3

California

For a user you know is a minor, disclose that they are interacting with artificial intelligence, and provide a clear and conspicuous break reminder by default at least every three hours during continuing interactions (Section 22602(c)(1) and (2), deleted by SB 1119 effective )
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Where the output is used; placing on the market Runtime reworded since it was classified
Companion Chatbot Safety and Accountability Act (SB 243), Cal. Bus. and Prof. Code Sections 22601 to 22606 Source as of ai:us-ca-cal-bus-prof-sections-22601-22606:2

Texas

Do not limit, segregate or classify an employee or applicant in a way that would deprive or tend to deprive the person of employment opportunities or otherwise adversely affect the person's status on the basis of genetic information or a refusal to submit to a genetic test (Tex. Labor Code sec. 21.402(d)).
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Texas employer prohibition on discrimination based on genetic information or refusal of a genetic test, Tex. Labor Code sec. 21.402 Source as of privacy:us-tx-tex-labor-sec-21-402:1

Brazil

Configure any product or service directed at children and adolescents, or likely to be accessed by them, by default to the most protective privacy and data-protection setting available, and do not process their personal data in a way that causes, facilitates or contributes to a violation of their privacy.
Type Mandatory Obligation Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
ECA Digital (Lei nº 15.211/2025), children's personal data and profiling, Lei nº 15.211, de 17 de setembro de 2025 (Estatuto Digital da Criança e do Adolescente), arts. 7º, 16, 22 and 26 Source as of privacy:br-lei-no-15-211-de-17-de-setembro-de-2025-estat:0

Germany

Build the record so that insured persons can consent to access to specific documents and data sets or to groups of them, and so that access by authorized care providers is limited by default to one week (Section 342, paragraph 2).
Type Mandatory Obligation Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Social Code Book V Section 342, Electronic Patient Record with Opt-Out, Fünftes Buch Sozialgesetzbuch (SGB V), § 342 Abs. 1 und 2 Source as of privacy:de-funftes-buch-sozialgesetzbuch-sgb-v-342-abs-1:1

Nigeria

Extend the freeze to all funds or other assets owned or controlled by the designated person or entity and not just those tied to a particular act, plot or threat, to funds or assets wholly or jointly owned or controlled directly or indirectly by designated persons or entities, to funds or assets derived or generated from them, and to funds or assets of persons and entities acting on behalf of or at the direction of designated persons or entities (section 54(2)).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Terrorism (Prevention and Prohibition) Act 2022, immediate freezing of the funds of designated persons and monitoring of accounts against the sanctions lists, Terrorism (Prevention and Prohibition) Act, 2022, ss. 54 and 61 Source as of ai:ng-terrorism-prevention-prohibition-2022-ss-54-6:2

Kenya

Failing to make this report is itself an offence: a fine of up to two hundred thousand shillings, imprisonment of up to two years, or both; the Committee may separately propose isolating a suspected system pending resolution.
Type Consequence (penalty or remedy) Modal may Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook Placing on the market; establishment of the manufacturer Runtime not a duty
Computer Misuse and Cybercrimes Act, Reporting of Cyber Threat, Computer Misuse and Cybercrimes Act (No. 5 of 2018), s. 40 Source as of security:ke-computer-misuse-cybercrimes-no-5-2018-s-40:3

United States

Have a reasonable basis to believe that a series of recommended transactions, even if in the retail customer's best interest when viewed in isolation, is not excessive and is in the retail customer's best interest when taken together in light of the customer's investment profile (Rule 15l-1(a)(2)(ii)(C)).
Type Recommendation/Guidance Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Regulation Best Interest, standard of conduct for broker-dealers, 17 CFR 240.15l-1 Source as of ai:us-17-cfr-240-15l-1:4

Andorra

Apply data protection by design and by default, keep a written record of your processing activities unless you employ fewer than fifty workers and none of the high-risk, non-occasional or special-category exceptions apply, and block rather than delete personal data pending any liability claim when you rectify or erase it.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
LQPD, Llei 29/2021 del 28 d'octubre, LQPD, Llei 29/2021 del 28 d'octubre, arts. 1-2, 4-7, 11-14, 27-35, 38-41 (general provisions, lawful basis, controller and processor obligations, DPIA, the Data Protection Officer, and other general processing rules) Source as of privacy:ad-llei-qualificada-de-proteccio-de-dades-person:2

Albania

Implement data protection by design and by default in every processing tool and process, and appoint a data protection officer where processing is carried out by a public authority, requires regular and systematic large scale monitoring of data subjects, or involves large scale processing of sensitive data or criminal records.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Law No. 124/2024 On the Protection of Personal Data, Law No. 124/2024 (Ligj Nr. 124/2024) On the Protection of Personal Data, Arts. 1-8, 11, 22-38, 43-46 (general provisions, lawful basis, consent, controller and processor obligations, and specific-purpose exceptions), in force Source as of privacy:al-no-124-2024-ligj-nr-124-2024-protection-perso:2

Benin

Implement data protection by design and by default, including pseudonymization and data minimization, so that only the personal data necessary to each specific purpose is processed by default.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Loi n°2017-20 du 20 avril 2018, Livre V, Protection des Données à Caractère Personnelle, portant Code du Numérique en République du Bénin, arts. 379-390, 393, 405-414, 424-426 et 428-436 (principes généraux, licité et obligations des responsables de traitement) Source as of privacy:bj-loi-n-2017-20-du-20-avril-2018-livre-v-protec:6

Bhutan

An app that negligently fails to implement reasonable security practices for personal data of a person in Bhutan, including a biometric identifier, and thereby causes wrongful loss or gain, is liable to pay court-determined compensation to the victim, and unlawfully disclosing another's personal data without consent is a separate offence under section 388.
Type Consequence (penalty or remedy) Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook Establishment of the operator Runtime not a duty
Information, Communications and Media Act of Bhutan 2018, offences and compensation for data failures, Information, Communications and Media Act of Bhutan 2018, ss.387-388 Source as of privacy:bt-information-communications-media-bhutan-201-4:0

Botswana

Implement appropriate technical and organisational measures, including data protection by design and by default, to secure personal data at a level appropriate to the risk and to be able to demonstrate compliance with the Act.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Data Protection Act, 2024 (Act No. 18 of 2024), Data Protection Act, 2024 (Act No. 18 of 2024), ss. 1-5, 19-28, 51-62, 65-73 Source as of privacy:bw-data-protection-2024-no-18-2024:3

Quebec

Designate a person in charge of the protection of personal information, by default your enterprise's highest-ranking officer, and publish that person's title and contact information on your website.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject; establishment of the operator Runtime not yet classified
Act respecting the protection of personal information in the private sector, comprehensive regime, CQLR c P-39.1, ss. 3.1-3.4, 8.1, 12-14 Source as of privacy:ca-qc-cqlr-c-p-39-1-ss-3-1-3-4-8-1-12-14:0

56 more lines in force under this theme, and 82 lines in all, are in the LexLint law library, each on the summary page of its instrument.

T04 · Agent Identity & Delegation

The group's key concepts: AuthN/Z model; acting-on-behalf-of; agent registry; credential lifecycle; delegation scope; non-repudiation

633 lines 591 in force 515 provisions 192 jurisdictions by type: conditional obligation 271, mandatory obligation 228, prohibition 88, definition 26, consequence (penalty or remedy) 8, permission or exemption 6, recommendation/guidance 6

Classes its lines carry: secure the system and the data in it (257), govern the system: policies, roles, assessments (191), disclose the use of AI (135), do not do the named thing (100); 88 from an instrument with no class recorded.

Sample requirement lines Show 13 of the 591 lines in forceHide the sample

What follows is a sample of 13 requirement lines from the LexLint law library, chosen to span jurisdictions.

European Union

Keep at the disposal of the competent authority, for five years, the relevant data relating to all orders and all transactions in financial instruments which you have carried out, whether on own account or on behalf of a client (Regulation (EU) No 600/2014, Article 25(1)).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
MiFID II and MiFIR Records of Services, Activities, Orders and Transactions (Article 16(6) and MiFIR Article 25), Directive 2014/65/EU, Article 16(6), with Regulation (EU) No 600/2014, Article 25(1) Source as of ai:eu-2014-65-eu-16-6-with-eu-no-600-2014-25-1:2

California

The prohibition reaches using a bot to mislead a Californian about its artificial identity in order to incentivize a commercial transaction or influence a vote
Type Prohibition Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Where the output is used; placing on the market Runtime Detectable at a runtime control
Bolstering Online Transparency Act (SB 1001), Cal. Bus. and Prof. Code Sections 17940 to 17943 Source as of ai:us-ca-cal-bus-prof-sections-17940-17943:1

Colorado

Do not unfairly discriminate based on race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression, in any insurance practice.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
SB 21-169 (2021), Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, C.R.S. 10-3-1104.9 Source as of ai:us-co-c-r-s-10-3-1104-9:0

Texas

Do not develop or distribute an AI system with the sole intent of producing or distributing AI-generated child pornography or deepfake sexually explicit media, or that engages in text-based sexual conversation while impersonating a child younger than 18.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
TRAIGA (H.B. 149, 2025), prohibited AI practices binding any person, Tex. Bus. & Com. Code §§ 552.052, 552.055-552.057 Source as of ai:us-tx-tex-bus-com-552-052-552-055-552-057:3

South Korea

Do not build, install, or distribute a tool whose purpose is to bypass a network's normal access-control or authentication procedures.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Operator Hook Location of the counterparty's machine Runtime Outside any runtime path
Information and Communications Network Act, Article 48 (network intrusion and anti-circumvention), Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc. (Act No. 21305, as amended), Art. 48 Source as of scraping:kr-promotion-information-communications-network:1

United Kingdom

Do not make or adapt a thing, or supply or offer to supply a thing, for use as a generator of purported intimate images, meaning a thing for creating, or facilitating the creation of, purported intimate images of a person.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Making or Supplying a Generator of Purported Intimate Images, Crime and Policing Act 2026, c. 20, s. 99, inserting ss. 66I-66L into the Sexual Offences Act 2003 Source as of ai:gb-crime-policing-2026-c-20-s-99-inserting-ss-66:0

Brazil

This duty does not reach ordinary image- or sound-quality adjustments, graphic identity elements, or customary campaign marketing techniques such as composite photos.
Type Permission or exemption Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook Where the output is used; placing on the market Runtime not a duty
TSE Resolution, AI-Generated Content Disclosure Duty, Resolução TSE nº 23.610/2019, art. 9º-B (redação dada pela Resolução TSE nº 23.732, de 27 de fevereiro de 2024) Source as of ai:br-resolu-o-tse-n-23-610-2019-9-b-reda-o-dada-pe:2

India

Inform your users that directing or causing your computer resource to produce or spread such prohibited information may attract penalty or punishment under law, and may lead to removal of the information, suspension or termination of the user's account without vitiating the evidence, and disclosure of the user's identity to a victim who complains.
Type Mandatory Obligation Modal may Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Where the output is used; placing on the market Runtime not yet classified
Synthetically Generated Information Labelling Duty for Intermediaries, Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, rule 3(3), as inserted by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (G.S.R. 120(E), dated ) Source as of ai:in-information-technology-intermediary-guideline:3

Germany

If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
Type Conditional Obligation Modal imperative Binds, by its wording Controller (the party that decides why and how personal data is processed) Scope turns on reworded since it was classified Hook Residence of the affected person Runtime reworded since it was classified
GDPR Articles 33-34, Breach Notification in Germany, Regulation (EU) 2016/679, Arts. 33-34 Source as of privacy:de-eu-2016-679-33-34:1

Ireland

Do not distribute, publish or threaten to distribute or publish an intimate image of another person without that person's consent, with intent to cause harm or being reckless as to whether harm is caused, including an image that only purports to be that person's intimate depiction, such as an AI-generated or digitally altered synthetic image (s. 2).
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
Harassment, Harmful Communications and Related Offences Act 2020, Intimate Image Offences, Harassment, Harmful Communications and Related Offences Act 2020 (No. 32 of 2020), ss. 1-3 Source as of ai:ie-harassment-harmful-communications-2020-ss-2-3:0

Italy

If you are a police force, use real-time remote biometric identification in public or publicly accessible places only for the purposes in article 8, comma 1, and only to confirm the identity of, or to search in a targeted way for, specifically named persons (art. 8, commi 1 and 2).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), D.Lgs. 9 settembre 2026, n. 160, artt. 7-9 e 13 Source as of ai:it-d-lgs-9-settembre-2026-n-160-artt-7-9-e-13:2

Spain

If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
Type Conditional Obligation Modal imperative Binds, by its wording Controller (the party that decides why and how personal data is processed) Scope turns on not yet classified Hook Residence of the affected person Runtime not yet classified
GDPR Articles 33-34 and LOPDGDD Articles 73(r)-(s) and 74(m)-(n), Breach Notification, Regulation (EU) 2016/679, Arts. 33-34; LOPDGDD, Art. 73(r)-(s), Art. 74(m)-(n) Source as of privacy:es-eu-2016-679-33-34-lopdgdd-69-73-r-s:1

France

If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
Type Conditional Obligation Modal imperative Binds, by its wording Controller (the party that decides why and how personal data is processed) Scope turns on not yet classified Hook Residence of the affected person Runtime not yet classified
GDPR Articles 33-34, Breach Notification, Regulation (EU) 2016/679, Arts. 33-34 Source as of privacy:fr-eu-2016-679-33-34:1

578 more lines in force under this theme, and 633 lines in all, are in the LexLint law library, each on the summary page of its instrument.

T05 · Guardrails & Policy Constraints

The group's key concepts: Business rules; policy-as-code; content filters; hard stops; behavioral boundaries; PEP; constraint override

781 lines 720 in force 601 provisions 222 jurisdictions by type: mandatory obligation 305, prohibition 241, conditional obligation 210, definition 9, permission or exemption 9, recommendation/guidance 4, consequence (penalty or remedy) 3

Classes its lines carry: secure the system and the data in it (225), govern the system: policies, roles, assessments (174), do not do the named thing (168), get consent first (126); 154 from an instrument with no class recorded.

Sample requirement lines Show 13 of the 720 lines in forceHide the sample

What follows is a sample of 13 requirement lines from the LexLint law library, chosen to span jurisdictions.

European Union

Do not create any ambiguity or confusion about your responsibilities in the process when assessing suitability, and inform clients or potential clients, clearly and simply, that the reason for assessing suitability is to enable you to act in the client's best interest (Article 54(1)).
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
MiFID II Suitability Assessment for Investment Advice and Portfolio Management, Including Automated and Semi-Automated Systems (Article 25(2) and Delegated Regulation 2017/565 Article 54), Directive 2014/65/EU, Article 25(2), supplemented by Commission Delegated Regulation (EU) 2017/565, Article 54 Source as of ai:eu-2014-65-eu-25-2-supplemented-by-commission-de:3

California

Do not create and intentionally disclose, or intentionally disclose, digitized sexually explicit material (an image, video or other visual or audiovisual work created or substantially altered through digitization that shows a depicted individual in the nude or appearing to engage in, or being subjected to, sexual conduct) if you know, or reasonably should know, that the person depicted did not consent or was a minor when the material was created
Type Prohibition Modal do not, should Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Deepfake Pornography Civil Liability Law (AB 621), Cal. Civ. Code Section 1708.86 (AB 621, Ch. 673, Stats. 2025) Source as of ai:us-ca-cal-civ-1708-86-ab-621-ch-673-stats-2025:0

Colorado

Process personal data with reasonable and appropriate administrative, technical, organizational and physical safeguards (Rule 6.09).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject; establishment of the operator Runtime not yet classified
Colorado Privacy Act Rules (Attorney General), 4 CCR 904-3 Source as of privacy:us-co-4-ccr-904-3:5

Texas

Respond to a civil investigative demand from the Attorney General, which may ask for a high-level description of your system's purpose, intended use, deployment context and benefits, the type of data used to program or train it, the categories of input data, its outputs, performance metrics, known limitations, and post-deployment monitoring and user safeguards (s. 552.103).
Type Mandatory Obligation Modal may Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
TRAIGA (H.B. 149, 2025), Attorney General enforcement, civil investigative demand, cure period, penalties and defenses, Tex. Bus. & Com. Code §§ 552.101-552.106 Source as of ai:us-tx-tex-bus-com-552-101-552-106:1

South Korea

An app processing Korean personal data must be able to answer to the PIPC for its lawful basis and safeguards, and an individual harmed by a security failure may bring a private civil claim for statutory damages, or damages up to five times the actual loss, without needing to prove the controller's negligence.
Type Consequence (penalty or remedy) Modal must, may Binds, by its wording Controller (the party that decides why and how personal data is processed) Scope turns on not a duty Hook Establishment of the operator Runtime not a duty
Personal Information Protection Act, enforcement and private civil remedy, Act No. 10465 (as amended by Act No. 19234, 2023), Arts. 39, 39-2, 51, 64-2 Source as of privacy:kr-no-10465-as-amended-by-no-19234-2023-39-39-2:0

United Kingdom

Where you take a significant decision about a person, one with a legal effect or a similarly significant effect, based solely on automated processing of their personal data, have safeguards in place that give the person information about the decision, let them make representations, let them obtain human intervention from you and let them contest the decision.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Automated Decision-Making: Significant Decisions Based Solely on Automated Processing (UK GDPR Articles 22A to 22D), Data (Use and Access) Act 2025, c. 18, s. 80, substituting Articles 22A to 22D into the UK GDPR Source as of ai:gb-data-use-access-2025-c-18-s-80-substituting-a:0

Brazil

Do not generate or digitally manipulate synthetic audio, video, or combined audio-video content to create, replace, or alter a living, deceased, or fictitious person's image or voice, even with that person's authorization, to harm or benefit a candidacy.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
TSE Resolution, Prohibition on Electoral Deepfakes, Resolução TSE nº 23.610/2019, art. 9º-C (redação dada pela Resolução TSE nº 23.732, de 27 de fevereiro de 2024) Source as of ai:br-resolu-o-tse-n-23-610-2019-9-c-reda-o-dada-pe:1

India

The Digital Personal Data Protection Rules, 2025 are only partly in force: today, only the Data Protection Board's own administrative machinery rules apply. Once fully in force (Rule 4 on , and the remaining app-facing rules, including consent-notice form, breach notification, and Significant Data Fiduciary duties, on ), an app processing Indian personal data, including a biometric identifier, must follow the notified consent-notice, security-safeguard, and breach-notification detail these Rules set.
Type Definition Modal may, must Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook Residence of the data subject; establishment of the operator Runtime not a duty
Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), Digital Personal Data Protection Rules, 2025, notified Source as of privacy:in-g-s-r-846-e-digital-personal-data-protection:0

Germany

Where a decision based solely on automated processing about a person in Germany rests on a contract with them or on their explicit consent, put suitable safeguards in place, at least the right to obtain human intervention, to express their point of view and to contest the decision, under GDPR Article 22(3).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject Runtime reworded since it was classified
GDPR Article 22 and BDSG Sections 31 and 37, Automated Decisions and Credit Scoring in Germany, Regulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22; Bundesdatenschutzgesetz (BDSG) §§31, 37 Source as of privacy:de-eu-2016-679-22-bundesdatenschutzgesetz-bdsg-3:0

Ireland

If you process personal data for health research in Ireland, take the safeguards listed in Regulation 3(1) of the Health Research Regulations 2018, including ethical approval of the research by a research ethics committee and controls to log who consulted, altered, disclosed or erased the personal data.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018, Safeguards and Explicit Consent for Health Research in Ireland, Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018 (S.I. No. 314 of 2018), regs. 3, 3A and 5, as amended by S.I. No. 18 of 2021 Source as of privacy:ie-data-protection-2018-36-2-health-research-reg:0

Italy

If the time limits are not observed or authorisation is refused, stop the use and delete the personal data, results and outputs, unless they are the body of the offence (art. 10, comma 2).
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), D.Lgs. 9 settembre 2026, n. 160, art. 10 Source as of ai:it-d-lgs-9-settembre-2026-n-160-10:2

Spain

Do not subject a person in Spain to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Residence of the data subject Runtime Enforceable at a runtime control
GDPR Article 22 and LOPDGDD Article 11(2), Automated Decisions in Spain, Regulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22; LOPDGDD, Ley Orgánica 3/2018, Art. 11(2) Source as of privacy:es-eu-2016-679-22-lopdgdd-ley-organica-3-2018-11:2

France

Do not create or share, by any means, a non-consensual sexual montage, or a non-consensual, algorithmically generated sexual image, video, or audio reproducing a real person's likeness or voice.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Establishment of the operator; placing on the market; where the output is used Runtime reworded since it was classified
Code Pénal Article 226-8-1, Non-Consensual Sexual Montage and Algorithmically Generated Sexual Content, Code penal, art. 226-8-1, insere par la loi n. 2024-449 du 21 mai 2024 visant a securiser et a reguler l'espace numerique (SREN), art. 21 Source as of ai:fr-penal-226-8-1-insere-par-la-loi-n-2024-449-du:0

707 more lines in force under this theme, and 781 lines in all, are in the LexLint law library, each on the summary page of its instrument.

T06 · Data Protection & Privacy

The group's key concepts: PII; data minimization; retention; residency; consent; cross-border transfer; special category data; privacy-by-design

6,211 lines 5,543 in force 2,314 provisions 271 jurisdictions by type: mandatory obligation 2,645, conditional obligation 2,005, prohibition 1,127, definition 279, consequence (penalty or remedy) 68, permission or exemption 56, recommendation/guidance 31

Classes its lines carry: get consent first (2,386), disclose the use of AI (1,960), honor the person's rights over their data (1,776), secure the system and the data in it (1,488); 1,133 from an instrument with no class recorded.

Sample requirement lines Show 13 of the 5,543 lines in forceHide the sample

What follows is a sample of 13 requirement lines from the LexLint law library, chosen to span jurisdictions.

European Union

Implement an IT strategy and arrangements for physical and electronic security that minimize the risks of attacks against your information systems, promptly inform the competent authority of any material breaches of your physical and electronic security measures with an incident report on the nature of the incident, the measures taken and the initiatives to avoid similar incidents, and annually undertake penetration tests and vulnerability scans (Article 18(1) to (4)).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), Directive 2014/65/EU, Article 17, supplemented by Commission Delegated Regulation (EU) 2017/589 Source as of ai:eu-2014-65-eu-17-supplemented-by-commission-dele:14

California

If you use automated decisionmaking technology (ADMT) to make a significant decision about a consumer (granting or denying financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, or healthcare services), give the consumer a Pre-use Notice describing that use and the consumer's rights to opt out of and access information about it
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
CCPA Automated Decisionmaking Technology Regulations, Cal. Code Regs. tit. 11, Sections 7200 to 7222 Source as of ai:us-ca-11-cal-regs-sections-7200-7222:0

Colorado

Do not allow an AI system to interact with a client in any form of therapeutic communication unless the regulated professional, the AI system and the client interact synchronously in real time, and do not let it generate therapeutic recommendations or treatment plans without the professional's review and approval
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
HB 26-1195 (2026), Psychotherapy Artificial Intelligence Restrictions, Colo. HB 26-1195, 2026 Colo. Sess. Laws ch. 358 Source as of ai:us-co-colo-hb-26-1195-2026-colo-sess-laws-ch-358:0

Texas

A person depicted in artificial intimate visual material, produced or disclosed without their consent and with intent to harm them, can sue the creator, solicitor, discloser, or promoter for damages if the material reveals their identity.
Type Consequence (penalty or remedy) Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook Establishment of the operator; placing on the market; where the output is used Runtime not a duty
S.B. 441 (2025), civil liability for artificial intimate visual material and nudification applications, Tex. Civ. Prac. & Rem. Code §§ 98B.0021-98B.009 Source as of ai:us-tx-tex-civ-prac-rem-98b-0021-98b-009:0

South Korea

Before you provide an AI system, or a product or service that uses one, review whether it is high-impact, meaning it may seriously affect a person's life, physical safety or fundamental rights and is used in energy supply, drinking water production, healthcare provision, medical and digital medical devices, nuclear material and facility safety, biometric identification for criminal investigation or arrest, hiring and loan decisions, transportation systems, public-service eligibility and fee decisions, and student assessment in early childhood, elementary and secondary education. You may ask the Ministry of Science and ICT to confirm your answer.
Type Mandatory Obligation Modal may Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
AI Framework Act, Article 34 (business-operator duties for high-impact AI), Act No. 20676, Article 34 Source as of ai:kr-no-20676-34:0

United Kingdom

Do not transfer the copy to another person, or use it for any other purpose, without the copyright owner's authorisation, as either infringes copyright.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Copies for Text and Data Analysis for Non-Commercial Research (Copyright, Designs and Patents Act 1988, s. 29A), Copyright, Designs and Patents Act 1988, c. 48, s. 29A Source as of ai:gb-copyright-designs-patents-1988-c-48-s-29a:2

Brazil

Establish a lawful basis under article 7 before processing personal data, including data the person has made public.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
Lei Geral de Proteção de Dados Pessoais (LGPD), Lei nº 13.709, de 14 de agosto de 2018 (LGPD), arts. 1º-10, 15-16, 23-32, 37-41, 46-47, 49-51 (general regime, principles, lawful basis, public-sector processing, agents and governance) Source as of privacy:br-lei-n-13-709-de-14-de-agosto-de-2018-lgpd:0

India

An app processing Indian personal data, including biometric identifiers, answers only to the Data Protection Board of India: the civil courts have no jurisdiction over a matter the Board is empowered to decide, and the Act arms no private plaintiff.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Establishment of the operator Runtime reworded since it was classified
Digital Personal Data Protection Act, 2023, Data Protection Board and penalties, Digital Personal Data Protection Act, 2023 (DPDPA), Data Protection Board and penalties, ss.18-26, 33, 39 Source as of privacy:in-digital-personal-data-protection-2023-dpdpa-d:0

Vietnam

Provide that information in compliance with the law on protecting state secrets, data, personal data and intellectual property.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Law on Artificial Intelligence, inspection and examination, Law No. 134/2025/QH15, art. 28 Source as of ai:vn-no-134-2025-qh15-28:1

Germany

Obtain the works council's consent to guidelines on personnel selection for hirings, transfers, regroupings and dismissals, also where artificial intelligence is used in drawing them up (section 95(1) and (2a)).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Betriebsverfassungsgesetz (BetrVG) Sections 80(3), 90(1) No. 3 and 95(2a), Works Council Rights on the Use of Artificial Intelligence, Betriebsverfassungsgesetz (BetrVG), §§ 80 Abs. 3, 90 Abs. 1 Nr. 3 and 95 Abs. 2a Source as of ai:de-betriebsverfassungsgesetz-betrvg-80-abs-3-90:2

Ireland

Do not distribute, publish or threaten to distribute or publish an intimate image of another person without that person's consent, with intent to cause harm or being reckless as to whether harm is caused, including an image that only purports to be that person's intimate depiction, such as an AI-generated or digitally altered synthetic image (s. 2).
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
Harassment, Harmful Communications and Related Offences Act 2020, Intimate Image Offences, Harassment, Harmful Communications and Related Offences Act 2020 (No. 32 of 2020), ss. 1-3 Source as of ai:ie-harassment-harmful-communications-2020-ss-2-3:0

Italy

Do not transfer, publish, or otherwise disseminate a falsified or altered image, video, or voice recording generated using an AI system, capable of misleading others as to its genuineness, without the depicted or recorded person's consent.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
Codice Penale Art. 612-quater, Illicit Dissemination of AI-Generated or AI-Altered Content, Codice Penale, art. 612-quater, inserted by Legge 23 settembre 2025, n. 132, art. 26, comma 1, lettera c) Source as of ai:it-cp-612quater-ai-deepfake-dissemination:0

Spain

Public administrations will favour mechanisms so that the algorithms they use in decision-making take account of criteria of bias minimisation, transparency and accountability, wherever technically feasible; the mechanisms cover the algorithm's design and training data and its potential discriminatory impact, and impact assessments to determine possible discriminatory bias are to be promoted (Ley 15/2022, article 23(1)).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Ley 15/2022 Article 23, Artificial Intelligence and Automated Decision-Making Mechanisms in Public Administrations, Ley 15/2022, de 12 de julio, integral para la igualdad de trato y la no discriminación, art. 23 (BOE-A-2022-11589) Source as of ai:es-ley-15-2022-de-12-de-julio-integral-para-la-2:0

5,530 more lines in force under this theme, and 6,211 lines in all, are in the LexLint law library, each on the summary page of its instrument.

T07 · Security & Access Controls

The group's key concepts: Least privilege; secrets management; network segmentation; tool permissions; authentication; vulnerability management; capability confinement

6,704 lines 6,310 in force 1,755 provisions 270 jurisdictions by type: mandatory obligation 3,394, conditional obligation 1,847, prohibition 915, definition 278, consequence (penalty or remedy) 102, permission or exemption 100, recommendation/guidance 68

Classes its lines carry: secure the system and the data in it (5,136), govern the system: policies, roles, assessments (2,668), get consent first (1,186), report to a regulator (1,157); 309 from an instrument with no class recorded.

Sample requirement lines Show 13 of the 6,310 lines in forceHide the sample

What follows is a sample of 13 requirement lines from the LexLint law library, chosen to span jurisdictions.

European Union

This Directive is addressed to the Member States (Article 97), which had to adopt and publish the measures necessary to comply with it by and apply them from (Article 93(1), as amended by Directive (EU) 2016/1034, Article 1, point (7)), so an investment firm meets Article 17 through each Member State's national law; Delegated Regulation (EU) 2017/589 is binding in its entirety and directly applicable in all Member States and applies from (Article 29).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), Directive 2014/65/EU, Article 17, supplemented by Commission Delegated Regulation (EU) 2017/589 Source as of ai:eu-2014-65-eu-17-supplemented-by-commission-dele:0

California

If you are a large frontier developer, make your published frontier AI framework describe your cybersecurity practices to secure unreleased model weights from unauthorized modification or transfer by internal or external parties (Section 22757.12(a)(7))
Type Conditional Obligation Modal imperative Binds, by its wording Developer, distributor or importer Scope turns on reworded since it was classified Hook Establishment of the operator; placing on the market; where the output is used Runtime reworded since it was classified
Transparency in Frontier Artificial Intelligence Act (SB 53), Cal. Bus. and Prof. Code Sections 22757.10 to 22757.16 Source as of ai:us-ca-cal-bus-prof-sections-22757-10-22757-16:1

Colorado

Do not disclose nonpublic personal health information about a consumer or customer without an authorization from that person, except for the insurance functions Section 18.B lists; an authorization is written or electronic, states how long it is valid (not more than 24 months) and may be revoked at any time (Sections 18 and 19).
Type Prohibition Modal do not, may Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Privacy of Consumer Financial and Health Information: insurance licensees' notice, opt-out and authorization duties, 3 CCR 702-6, Regulation 6-4-1 Source as of privacy:us-co-3-ccr-702-6-6-4-1:3

Texas

Unless you are a government, do not require an individual to transmit the individual's social security number over the Internet unless the connection is secure or the number is encrypted, and do not require it for access to a website unless a password, personal identification number or other authentication device is also required (Tex. Bus. & Com. Code sec. 501.001(a)(3), (4)).
Type Conditional Obligation Modal unless, do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Texas limits on public display, Internet transmission and mailing of Social Security numbers, Tex. Bus. & Com. Code sec. 501.001 Source as of privacy:us-tx-tex-bus-com-sec-501-001:1

South Korea

Prepare and keep documents that confirm the content of the measures you took to secure your AI's safety and reliability.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
AI Framework Act, Article 34 (business-operator duties for high-impact AI), Act No. 20676, Article 34 Source as of ai:kr-no-20676-34:5

United Kingdom

It reaches you if you operate as a creditor under a prospective regulated agreement, meaning the person providing credit under a consumer credit agreement, including the prospective creditor, where the agreement is a regulated agreement and is not an excluded agreement (a consumer hire agreement or an agreement secured on land): when you decide not to proceed with it on the basis of information you obtained from a credit reference agency, inform the debtor, when telling the debtor of the decision, that the decision was reached on the basis of information from a credit reference agency, and provide the debtor with the particulars of the agency, including its name, address and telephone number (Consumer Credit Act 1974, section 157(A1), (4); section 189).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Consumer Credit Act 1974, duty to tell a refused applicant that a credit reference agency was used and to give its name and address, Consumer Credit Act 1974, c. 39, s. 157 Source as of ai:gb-consumer-credit-1974-c-39-s-157:0

Brazil

Do not generate or digitally manipulate synthetic audio, video, or combined audio-video content to create, replace, or alter a living, deceased, or fictitious person's image or voice, even with that person's authorization, to harm or benefit a candidacy.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
TSE Resolution, Prohibition on Electoral Deepfakes, Resolução TSE nº 23.610/2019, art. 9º-C (redação dada pela Resolução TSE nº 23.732, de 27 de fevereiro de 2024) Source as of ai:br-resolu-o-tse-n-23-610-2019-9-c-reda-o-dada-pe:1

India

Get the rights holder's authorisation before reproducing or reusing copyrighted material, including a copyrighted database or compilation, to train an AI model; the fair-dealing exceptions do not name text-and-data-mining or AI training as a covered purpose.
Type Mandatory Obligation Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime Enforceable at a runtime control
Copyright Act, No Text-and-Data-Mining Exception, Database Compilations, and Technological Protection Measures, Copyright Act, 1957 (No. 14 of 1957), ss. 2(o), 51, 52, 63, 65A Source as of scraping:in-copyright-1957-no-14-1957-ss-2-o-51-52-63-65a:0

Vietnam

Continuously keep your AI system safe, secure, and reliable, and promptly detect and remedy any incident capable of harming people, property, data, or social order, regardless of the system's risk tier.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Law on Artificial Intelligence, incident management and reporting obligation, Law No. 134/2025/QH15, art. 12 Source as of ai:vn-no-134-2025-qh15-12:3

Germany

Where you deploy a biometric time clock, access control system, or voice-authentication system for employees in Germany, satisfy BDSG Section 26(3)'s conditions rather than relying on employee consent as the sole basis.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Operator Hook Residence of the data subject Runtime Outside any runtime path
GDPR Article 9 and BDSG Section 26(3), Special Categories of Personal Data and Their Processing for Employment in Germany, Regulation (EU) 2016/679, Art. 9; Bundesdatenschutzgesetz (BDSG) §26(3) Source as of privacy:de-eu-2016-679-9-bundesdatenschutzgesetz-bdsg-26:0

Ireland

Do not knowingly give false or misleading information to an adjudicator, or disclose confidential material relevant to an adjudicator's finding without authorisation (ss. 95, 104).
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Establishment of the operator; placing on the market; where the output is used Runtime reworded since it was classified
Regulation of Artificial Intelligence Act 2026, Regulation of Artificial Intelligence Act 2026 (No. 31 of 2026) Source as of ai:ie-regulation-of-artificial-intelligence-2026:1

Italy

Adopt the technical safety measures provided for the design, training, production and placing on the market of high-risk AI systems, suited to prevent malfunctions or alterations of how the systems work, and adopt human-oversight measures, where omitting them would endanger life or public or individual safety, or the security of the State (Codice Penale art. 437-bis, first paragraph).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Codice Penale, art. 437-bis, inserted by D.Lgs. 9 settembre 2026, n. 160, art. 12 Source as of ai:it-codice-penale-437-bis-inserted-by-d-lgs-9-set:0

Spain

Rely on an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Spain outside the EEA, and check whether LOPDGDD Articles 41-43 require AEPD authorization or prior notice for the specific transfer.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Destination of a transfer Runtime Enforceable at a runtime control
LOPDGDD Título VI, International Transfers, Layered on GDPR Chapter V, Regulation (EU) 2016/679, Arts. 44-49; LOPDGDD, Arts. 40-43, 72.1(l) Source as of privacy:es-eu-2016-679-44-49-83-5-lopdgdd-40-43-72-1-l:0

6,297 more lines in force under this theme, and 6,704 lines in all, are in the LexLint law library, each on the summary page of its instrument.

T08 · Model/Agent Risk Management

The group's key concepts: Validation; robustness; drift monitoring; change control; benchmarking; bias/fairness; decommissioning; version control

1,661 lines 1,375 in force 851 provisions 234 jurisdictions by type: mandatory obligation 881, conditional obligation 568, prohibition 129, definition 42, recommendation/guidance 30, permission or exemption 8, consequence (penalty or remedy) 3

Classes its lines carry: govern the system: policies, roles, assessments (950), secure the system and the data in it (828), assess the impact on personal data first (510), get consent first (405); 135 from an instrument with no class recorded.

Sample requirement lines Show 13 of the 1,375 lines in forceHide the sample

What follows is a sample of 13 requirement lines from the LexLint law library, chosen to span jurisdictions.

European Union

Have robust governance arrangements, which include a clear organizational structure with well-defined, transparent and consistent lines of responsibility (Article 74(1), point (a)).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Capital Requirements Directive, Robust Governance Arrangements of Institutions (Article 74(1)), Directive 2013/36/EU, Article 74(1) Source as of ai:eu-2013-36-eu-74-1:2

California

If you use automated decisionmaking technology (ADMT) to make a significant decision about a consumer (granting or denying financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, or healthcare services), give the consumer a Pre-use Notice describing that use and the consumer's rights to opt out of and access information about it
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
CCPA Automated Decisionmaking Technology Regulations, Cal. Code Regs. tit. 11, Sections 7200 to 7222 Source as of ai:us-ca-11-cal-regs-sections-7200-7222:0

Colorado

Establish a documented, risk-based governance and risk management framework, including a cross-functional governance group drawing on legal, compliance, risk management, product development, underwriting, actuarial, data science, marketing, and customer service, designed to determine through quantitative testing whether your use of an external consumer data and information source, or an algorithm or predictive model that uses one, results in unfair discrimination with respect to race, and to remediate any discrimination detected.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, 3 CCR 702-10, Regulation 10-1-1 Source as of ai:us-co-3-ccr-702-10-10-1-1:0

Texas

Do not develop or deploy an AI system with intent to unlawfully discriminate against a protected class; a disparate impact alone is not enough to show that intent.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
TRAIGA (H.B. 149, 2025), prohibited AI practices binding any person, Tex. Bus. & Com. Code §§ 552.052, 552.055-552.057 Source as of ai:us-tx-tex-bus-com-552-052-552-055-552-057:2

South Korea

Analyze and evaluate the vulnerabilities of the designated infrastructure on a regular basis as the Presidential Decree prescribes, and when the agency orders it after a new form of electronic intrusion or a material change (Article 9(1) and (2)).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator (entity in scope) Runtime not yet classified
Information and Communications Infrastructure Protection Act, Protection Measures and Vulnerability Analysis, Act on the Protection of Information and Communications Infrastructure (정보통신기반 보호법, Act No. 6383, , as last amended by Act No. 20068, ), Arts. 5, 8 to 11 and 30 Source as of security:kr-protection-information-communications-infrast:3

United Kingdom

It reaches you if you operate as a service-provider, meaning a person concerned with the provision of a service to the public or a section of the public (for payment or not), and a service includes goods or facilities: do not discriminate against a person requiring the service, including a person seeking to obtain or use it, by not providing the person with the service, which includes not providing it of the quality, in the manner or on the terms on which you usually provide it to the public or the section of it that includes the person (Equality Act 2010, section 29(1), section 31(2), (6) and (7)).
Type Conditional Obligation Modal do not Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Equality Act 2010, discrimination by a service-provider, with indirect discrimination and the exceptions for financial services and insurance, Equality Act 2010, c. 15, ss. 19, 29 Source as of ai:gb-equality-2010-c-15-ss-19-29:0

Brazil

Establish a lawful basis under article 7 before processing personal data, including data the person has made public.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
Lei Geral de Proteção de Dados Pessoais (LGPD), Lei nº 13.709, de 14 de agosto de 2018 (LGPD), arts. 1º-10, 15-16, 23-32, 37-41, 46-47, 49-51 (general regime, principles, lawful basis, public-sector processing, agents and governance) Source as of privacy:br-lei-n-13-709-de-14-de-agosto-de-2018-lgpd:0

India

Adopt a telecom cyber security policy that covers security safeguards, risk management approaches, training, telecommunication network testing including hardening, vulnerability assessment and penetration testing, risk assessment and prevention of security incidents, a rapid action system to deal with security incidents, and forensic analysis of security incidents, and inform the Central Government that you have adopted it (rule 4(4)(a) and (b)).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator (entity in scope) Runtime not yet classified
Telecom Cyber Security Rules, Security Policy, Audits, Security Operations Centre and Security Officer, Telecommunications (Telecom Cyber Security) Rules, 2024 (G.S.R. 720(E)), rr. 4(3), 4(4) and 6 Source as of security:in-telecommunications-telecom-cyber-security-rul:1

Vietnam

Set quality criteria for the AI system's data, model and outputs, and build internal testing, validation and verification mechanisms before deployment.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
National Artificial Intelligence Ethics Framework (Circular No. 05/2026/TT-BKHCN), Circular No. 05/2026/TT-BKHCN Source as of ai:vn-circular-no-05-2026-tt-bkhcn:2

Germany

Provide the information or documentation, and give the access, that Article 21 requires of a provider of a high-risk AI system when a competent authority asks; carry out and update the fundamental rights impact assessment Article 27 requires and send the notification it requires; if you are a notified body, inform the notifying authority as Article 45 requires; and, if you operate a high-risk AI system under point 1, 3, 4 or 5 of Annex III, give an affected person the explanation Article 86 requires (Section 15).
Type Conditional Obligation Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on reworded since it was classified Hook Establishment of the operator; placing on the market; where the output is used Runtime reworded since it was classified
Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-Marktüberwachungs-und-Innovationsförderungs-Gesetz, KI-MIG), §§ 2, 6, 8, 13, 15, 16, 20 Source as of ai:de-gesetz-zur-markt-berwachung-und-innovationsf:0

Ireland

If you process personal data for health research in Ireland, take the safeguards listed in Regulation 3(1) of the Health Research Regulations 2018, including ethical approval of the research by a research ethics committee and controls to log who consulted, altered, disclosed or erased the personal data.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018, Safeguards and Explicit Consent for Health Research in Ireland, Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018 (S.I. No. 314 of 2018), regs. 3, 3A and 5, as amended by S.I. No. 18 of 2021 Source as of privacy:ie-data-protection-2018-36-2-health-research-reg:0

Italy

Do not harass anyone on those grounds through unwanted conduct that violates a person's dignity and creates an intimidating, hostile, degrading, humiliating, or offensive climate, and do not order anyone to discriminate (art. 2, commi 3 and 4).
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Legislative Decree 216/2003, equal treatment in employment and working conditions, Decreto legislativo 9 luglio 2003, n. 216, artt. 2-5 Source as of ai:it-decreto-legislativo-9-luglio-2003-n-216-artt:1

Spain

Public administrations will favour mechanisms so that the algorithms they use in decision-making take account of criteria of bias minimisation, transparency and accountability, wherever technically feasible; the mechanisms cover the algorithm's design and training data and its potential discriminatory impact, and impact assessments to determine possible discriminatory bias are to be promoted (Ley 15/2022, article 23(1)).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Ley 15/2022 Article 23, Artificial Intelligence and Automated Decision-Making Mechanisms in Public Administrations, Ley 15/2022, de 12 de julio, integral para la igualdad de trato y la no discriminación, art. 23 (BOE-A-2022-11589) Source as of ai:es-ley-15-2022-de-12-de-julio-integral-para-la-2:0

1,362 more lines in force under this theme, and 1,661 lines in all, are in the LexLint law library, each on the summary page of its instrument.

T09 · Human Oversight

The group's key concepts: HITL/HOTL; escalation paths; human waterfall; override/kill switch; mandatory approval; supervision frequency; automated oversight

355 lines 269 in force 291 provisions 140 jurisdictions by type: mandatory obligation 153, conditional obligation 148, prohibition 34, definition 14, permission or exemption 3, consequence (penalty or remedy) 2, recommendation/guidance 1

Classes its lines carry: govern the system: policies, roles, assessments (94), report to a regulator (83), disclose the use of AI (70), secure the system and the data in it (63); 88 from an instrument with no class recorded.

Sample requirement lines Show 13 of the 269 lines in forceHide the sample

What follows is a sample of 13 requirement lines from the LexLint law library, chosen to span jurisdictions.

European Union

It reaches you if you are an investment firm that engages in algorithmic trading, meaning trading in financial instruments where a computer algorithm automatically determines individual parameters of orders such as whether to initiate the order, the timing, price or quantity of the order or how to manage the order after its submission, with limited or no human intervention; a system used only to route orders to one or more trading venues, to process orders involving no determination of any trading parameters, or to confirm orders or process executed transactions after the trade is outside that meaning (Directive 2014/65/EU, Article 4(1), point (39)). Have in place effective systems and risk controls suitable to the business you operate to ensure that your trading systems are resilient and have sufficient capacity, are subject to appropriate trading thresholds and limits, and prevent the sending of erroneous orders or the systems otherwise functioning in a way that may create or contribute to a disorderly market (Article 17(1)).
Type Conditional Obligation Modal subject to, may Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), Directive 2014/65/EU, Article 17, supplemented by Commission Delegated Regulation (EU) 2017/589 Source as of ai:eu-2014-65-eu-17-supplemented-by-commission-dele:1

California

Let a consumer opt out of your use of ADMT to make a significant decision about them, unless you offer an appeal to a human reviewer with authority to overturn the decision or another exception listed in the regulation applies
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Enforceable at a runtime control
CCPA Automated Decisionmaking Technology Regulations, Cal. Code Regs. tit. 11, Sections 7200 to 7222 Source as of ai:us-ca-11-cal-regs-sections-7200-7222:1

Colorado

Honor a consumer's request to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects where the profiling rests on solely automated processing or human reviewed automated processing (Rule 9.04).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject; establishment of the operator Runtime not yet classified
Colorado Privacy Act Rules (Attorney General), 4 CCR 904-3 Source as of privacy:us-co-4-ccr-904-3:4

South Korea

An app that makes a decision about a Korean data subject using a fully automated system, including one applying artificial intelligence, that significantly affects the subject's rights or obligations, must let the subject object to or request an explanation of the decision, must not apply the decision over an objection absent a compelling reason or must reprocess it with human involvement, and must disclose the criteria and procedures it uses for automated decisions.
Type Mandatory Obligation Modal must, must not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Personal Information Protection Act, rights regarding automated decisions, Act No. 10465 (as amended by Act No. 19234, 2023), Art. 37-2; Enforcement Decree of the Personal Information Protection Act (Presidential Decree No. 34309, ), Arts. 44-2 to 44-4 Source as of privacy:kr-no-10465-as-amended-by-no-19234-2023-37-2-enf:0

United Kingdom

Where you take a significant decision about a person, one with a legal effect or a similarly significant effect, based solely on automated processing of their personal data, have safeguards in place that give the person information about the decision, let them make representations, let them obtain human intervention from you and let them contest the decision.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Automated Decision-Making: Significant Decisions Based Solely on Automated Processing (UK GDPR Articles 22A to 22D), Data (Use and Access) Act 2025, c. 18, s. 80, substituting Articles 22A to 22D into the UK GDPR Source as of ai:gb-data-use-access-2025-c-18-s-80-substituting-a:0

Brazil

In your risk management procedures for business continuity, provide for timely communication to the Banco Central do Brasil of the occurrence of relevant incidents, and of interruptions of relevant data processing, storage and cloud computing services, that constitute a crisis situation for you, together with the measures to restart your activities (article 20, item III). The Resolution sets no number of hours; it says "tempestiva" (timely).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Placing on the market; establishment of the manufacturer Runtime not yet classified
BCB Resolution 85 of 2021, Communication of Relevant Incidents, Resolução BCB nº 85, de 8 de abril de 2021, arts. 20 e 22 Source as of security:br-resolucao-bcb-no-85-de-8-de-abril-de-2021-20:1

Vietnam

Build human oversight and intervention mechanisms proportionate to the AI system's impact, and keep the ability to intervene in its decisions and actions.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
National Artificial Intelligence Ethics Framework (Circular No. 05/2026/TT-BKHCN), Circular No. 05/2026/TT-BKHCN Source as of ai:vn-circular-no-05-2026-tt-bkhcn:3

Germany

If you operate an automated account in a social network whose profile looks like one provided for natural persons, label each piece of content or message that a computer programme creates automatically as created and sent automatically using a programme that controls the account (Medienstaatsvertrag, section 18(3)).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Where the output is used; placing on the market Runtime not yet classified
Medienstaatsvertrag (MStV) Section 18(3), Labelling of Automatically Created Content in Social Networks, Medienstaatsvertrag (MStV), § 18 Abs. 3 Source as of ai:de-medienstaatsvertrag-mstv-18-abs-3:0

Ireland

Where a decision based solely on automated processing about a person in Ireland rests on a contract with them or on their explicit consent, put suitable safeguards in place, at least the right to obtain human intervention, to express their point of view and to contest the decision, under GDPR Article 22(3).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject Runtime reworded since it was classified
GDPR Article 22 and Data Protection Act 2018 Section 57, Automated Decision-Making in Ireland, Regulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22; Data Protection Act 2018, s. 57 Source as of privacy:ie-eu-2016-679-22-as-transposed-by-data-protecti:0

Italy

If you use AI systems in decisions about the employment relationship, do not take the final decision to create, change or end it, including a disciplinary measure or a performance evaluation, solely on automated processing, and reserve it to a natural person with effective and autonomous power.
Type Conditional Obligation Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Decreto Legislativo 179/2026 Art. 41, Employer Decisions Assisted by AI Systems (Final Decisions Reserved to a Person), D.Lgs. 7 ottobre 2026, n. 179, art. 41 Source as of ai:it-d-lgs-7-ottobre-2026-n-179-41:0

Spain

Give a person in Spain a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Residence of the data subject Runtime Outside any runtime path
GDPR Article 22 and LOPDGDD Article 11(2), Automated Decisions in Spain, Regulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22; LOPDGDD, Ley Orgánica 3/2018, Art. 11(2) Source as of privacy:es-eu-2016-679-22-lopdgdd-ley-organica-3-2018-11:0

France

Give a person in France a path to obtain human intervention, express their view, and contest a decision made solely by automated processing, including profiling, that produces a legal or similarly significant effect on them.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Residence of the data subject Runtime Outside any runtime path
GDPR Article 22, Right Against Automated Individual Decision-Making, Regulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22 Source as of privacy:fr-eu-2016-679-22:0

Netherlands

Give a person in the Netherlands a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them, subject to UAVG Article 40's exceptions.
Type Conditional Obligation Modal subject to Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Residence of the data subject Runtime Outside any runtime path
GDPR Article 22 and UAVG Article 40, Automated Decisions in the Netherlands, Regulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22; UAVG, Art. 40 Source as of privacy:nl-eu-2016-679-22-uavg-40:0

256 more lines in force under this theme, and 355 lines in all, are in the LexLint law library, each on the summary page of its instrument.

T10 · Action Management

The group's key concepts: Pre-execution checks; dual control; reversibility tiers; undo infrastructure; action scope limits; side-effect disclosure

213 lines 186 in force 195 provisions 107 jurisdictions by type: mandatory obligation 75, conditional obligation 64, prohibition 50, definition 9, permission or exemption 9, consequence (penalty or remedy) 6

Classes its lines carry: govern the system: policies, roles, assessments (56), secure the system and the data in it (56), get consent first (51), do not do the named thing (35); 40 from an instrument with no class recorded.

Sample requirement lines Show 13 of the 186 lines in forceHide the sample

What follows is a sample of 13 requirement lines from the LexLint law library, chosen to span jurisdictions.

European Union

Carry out pre-trade controls on order entry for all financial instruments, namely price collars, maximum order values, maximum order volumes and maximum messages limits, immediately include all orders sent to a trading venue in the calculation of those limits, and have repeated automated execution throttles that disable the trading system after a pre-determined number of repeated executions until a designated staff member re-enables it (Article 15(1) to (3)); set market and credit risk limits based on your capital base, clearing arrangements, trading strategy, risk tolerance, experience and certain variables (Article 15(4)).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), Directive 2014/65/EU, Article 17, supplemented by Commission Delegated Regulation (EU) 2017/589 Source as of ai:eu-2014-65-eu-17-supplemented-by-commission-dele:12

California

Post training-data documentation on your website before making a generative AI system publicly available to Californians, and again before any substantial modification
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Provider Hook Establishment of the operator; placing on the market; where the output is used Runtime Outside any runtime path
Generative AI Training Data Transparency Act (AB 2013), Cal. Civ. Code Sections 3110 and 3111 Source as of ai:us-ca-cal-civ-sections-3110-3111:0

Texas

If you are a health care practitioner using AI for diagnostic purposes, including AI-generated recommendations on a diagnosis or course of treatment, stay within the scope of your license, do not use AI in a way state or federal law otherwise restricts, and review all AI-created records consistent with Texas Medical Board standards.
Type Conditional Obligation Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Outside any runtime path
S.B. 1188 (2025), AI diagnostic disclosure duty in electronic health records, Tex. Health & Safety Code § 183.005 Source as of ai:us-tx-tex-health-safety-183-005:0

South Korea

Have pseudonymized information held by different controllers combined, for those purposes, only by a specialized institution designated by the Protection Commission or the head of the relevant central administrative agency, and obtain the approval of that institution's head before taking the combined information out of it, after processing it into pseudonymized information or the form Article 58-2 covers (Article 28-3).
Type Mandatory Obligation Modal imperative Binds, by its wording Controller (the party that decides why and how personal data is processed) Scope turns on not yet classified Hook Residence of the data subject; establishment of the operator Runtime not yet classified
Personal Information Protection Act, pseudonymized information, Act No. 10465 (as amended by Act No. 21445, 2026), Arts. 28-2 to 28-5 and 28-7; Arts. 64-2 and 71 (penalties) Source as of privacy:kr-no-10465-as-amended-by-no-21445-2026-28-2-28:1

United Kingdom

It reaches you if you are a firm that makes a personal recommendation to a retail client in relation to a designated investment, manages investments of a retail client of the firm, or manages the assets of an occupational pension scheme, stakeholder pension scheme or personal pension scheme, other than in relation to your MiFID, equivalent third country or optional exemption business or an insurance-based investment product, for which COBS 9A sets the suitability rules (COBS 9.1.1R and COBS 9.1.1AG), and not in relation to a targeted support service within the scope of COBS 9B (COBS 9.1.1BG): take reasonable steps to ensure that a personal recommendation, or a decision to trade, is suitable for your client, and ensure that any life policy proposed is consistent with the client's insurance demands and needs (COBS 9.2.1R(1)).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Suitability for business that is not MiFID business: personal recommendations to retail clients and decisions to trade for them (COBS 9.1 and 9.2), FCA Handbook, COBS 9 Source as of ai:gb-fca-handbook-cobs-9:0

Spain

If you run a public or private health centre or service in Spain, adopt measures that keep patients' health data confidential and allow access to it only with prior authorization backed by law (Ley 41/2002, Article 7).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Ley 41/2002, Confidentiality of Patients' Health Data and Security of Clinical Records in Spain, Ley 41/2002, arts. 7, 16 and 17 Source as of privacy:es-ley-41-2002-7-16-17:0

Canada

Review the information collected about the client no less frequently than once every 12 months for managed accounts, within 12 months before making a trade for or recommending a trade to the client if you are an exempt market dealer, and in any other case no less frequently than once every 36 months (section 13.2(4.1)).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
National Instrument 31-103, know your client and know your product, National Instrument 31-103, ss. 13.2, 13.2.1 Source as of ai:ca-national-instrument-31-103-ss-13-2-13-2-1:5

Peru

A quotation from a lawfully disclosed work may be made without the author's consent or payment if the author's name and the source are stated and the quotation follows proper practice and does not exceed what its purpose justifies.
Type Permission or exemption Modal may Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime not a duty
Decreto Legislativo 822, quotation exception, Decreto Legislativo 822, art. 44 (quotation exception), Ley sobre el Derecho de Autor, as consolidated to Decreto Legislativo 1724 (2026) Source as of scraping:pe-decreto-legislativo-822-44-quotation-exceptio:0

South Africa

Obtain the Information Regulator's prior authorisation before transferring special personal information, or a child's personal information, to a country that does not provide an adequate level of protection.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Destination of a transfer Runtime not yet classified
Protection of Personal Information Act, cross-border transfer, POPIA, s. 72 (transfer of personal information outside the Republic) Source as of privacy:za-popia-s-72-transfer-personal-information-outs:1

Nigeria

Obtain prior approval from the Commission before placing any advertisement on your website or other channels, and do not display ratings, rankings, endorsements or bestsellers of insurance products on your website (paragraphs 11.2(c) and 13.2(iii)). Seek the Commission's prior approval before engaging service providers or third-party vendors and before changing the location of the servers hosting your domain (paragraph 18.3(iii)).
Type Mandatory Obligation Modal do not Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
National Insurance Commission Guidelines for Insurtech Operations in Nigeria, licensing, technology security, lead management and limits on automated claims rejection, Guidelines for Insurtech Operations in Nigeria, August 2025 Source as of ai:ng-guidelines-insurtech-operations-in-nigeria-au:6

United States

It reaches you if you operate as a creditor: a person who regularly extends, renews, or continues credit, who regularly arranges for credit to be extended, renewed, or continued, or who, in the ordinary course of business, regularly participates in a credit decision, including setting the terms of the credit, but not a person whose only participation in a credit transaction involves honoring a credit card. The duty is triggered by adverse action, which does not include a refusal to extend additional credit under an existing credit arrangement where the applicant is delinquent or otherwise in default, or where the additional credit would exceed a previously established credit limit (15 U.S.C. 1691(d)(6)). A creditor must notify an applicant of the action taken within 30 days after receiving a completed application (15 U.S.C. 1691(d)(1); 12 CFR 1002.9(a)(1)(i)).
Type Conditional Obligation Modal must Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Equal Credit Opportunity Act and Regulation B, notice of action taken and statement of specific reasons for adverse action, 15 U.S.C. § 1691(d); 12 CFR § 1002.9 Source as of ai:us-15-u-s-c-1691-d-12-cfr-1002-9:0

Andorra

This duty reaches your service where you employ 50 or more people, or your annual turnover or annual balance sheet total exceeds ten million euros, and you fall within an Annex I essential-entity sector (energy, transport, banking, financial-market infrastructure, health, water, digital infrastructure, public administration) or an Annex II important-entity sector, which names providers of online marketplaces, online search engines and social networking services platforms among Andorra's digital service providers.
Type Definition Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not a duty Hook Establishment of the operator (entity in scope) Runtime not a duty
Llei 22/2022, Cybersecurity Risk-Management Obligations, Llei 22/2022, del 9 de juny, arts. 12, 13, 17 i 18 Source as of security:ad-llei-22-2022-del-9-de-juny-12-13-17-i-18:0

Angola

Notify the Agência de Protecção de Dados, or obtain the recipient's express consent, before sending postal or electronic marketing messages or recording a call for commercial purposes, and let the recipient object to further messages free of charge at any time.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Law on the Protection of Personal Data, Lei n.º 22/11, de 17 de Junho de 2011 (Protecção de Dados Pessoais), arts. 1-12, 16, 18-24, 30-32, 35-43 and 63-67 Source as of privacy:ao-lei-n-22-11-de-17-de-junho-de-2011-protec-o-d:2

173 more lines in force under this theme, and 213 lines in all, are in the LexLint law library, each on the summary page of its instrument.

T11 · Monitoring & Logging

The group's key concepts: Audit trails; prompt/tool logs; decision logs; log retention; log integrity; tamper-evidence; real-time alerting

702 lines 606 in force 514 provisions 191 jurisdictions by type: mandatory obligation 365, conditional obligation 272, prohibition 31, definition 20, recommendation/guidance 9, consequence (penalty or remedy) 3, permission or exemption 2

Classes its lines carry: govern the system: policies, roles, assessments (372), secure the system and the data in it (369), report to a regulator (114), disclose the use of AI (102); 64 from an instrument with no class recorded.

Sample requirement lines Show 13 of the 606 lines in forceHide the sample

What follows is a sample of 13 requirement lines from the LexLint law library, chosen to span jurisdictions.

European Union

Have effective processes to identify, manage, monitor and report the risks you are or might be exposed to, including ESG risks in the short, medium and long term (Article 74(1), point (b)).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Capital Requirements Directive, Robust Governance Arrangements of Institutions (Article 74(1)), Directive 2013/36/EU, Article 74(1) Source as of ai:eu-2013-36-eu-74-1:3

California

Maintain records of consumer requests and how you responded for at least 24 months, as a ticket or log with the date, nature and manner of the request, the date and nature of your response, and the basis for any denial, protected by reasonable security procedures and practices (section 7101).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject; establishment of the operator Runtime not yet classified
CCPA Regulations: training, record-keeping and metrics (article 8), Cal. Code Regs. tit. 11, sections 7100 to 7102 Source as of privacy:us-ca-cal-regs-tit-11-sections-7100-7102:1

Colorado

Retain each authorization, or a copy, in the record of the individual who is the subject of the nonpublic personal health information (Section 19.D).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Privacy of Consumer Financial and Health Information: insurance licensees' notice, opt-out and authorization duties, 3 CCR 702-6, Regulation 6-4-1 Source as of privacy:us-co-3-ccr-702-6-6-4-1:4

Texas

Respond to a civil investigative demand from the Attorney General, which may ask for a high-level description of your system's purpose, intended use, deployment context and benefits, the type of data used to program or train it, the categories of input data, its outputs, performance metrics, known limitations, and post-deployment monitoring and user safeguards (s. 552.103).
Type Mandatory Obligation Modal may Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
TRAIGA (H.B. 149, 2025), Attorney General enforcement, civil investigative demand, cure period, penalties and defenses, Tex. Bus. & Com. Code §§ 552.101-552.106 Source as of ai:us-tx-tex-bus-com-552-101-552-106:1

South Korea

Build a risk-management system that monitors and responds to AI-related safety accidents involving your system.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
AI Framework Act, Article 32 (safety-assurance duty for high-compute AI systems), Act No. 20676, Article 32 Source as of ai:kr-no-20676-32:1

United Kingdom

If you identify, through complaints, your internal monitoring or any other source, that retail customers have suffered foreseeable harm as a result of your acts or omissions, act in good faith and take appropriate action to rectify the situation, including providing redress where appropriate (PRIN 2A.2.5R).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
The Consumer Duty: Principle 12 and the cross-cutting rules and outcome rules for retail customers, FCA Handbook, PRIN 2A and Principle 12 Source as of ai:gb-fca-handbook-prin-2a-principle-12:4

Brazil

Keep a record of your processing operations, especially those based on legitimate interest, and name a person in charge (encarregado) whose identity and contact details you publish, preferably on your website.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Lei Geral de Proteção de Dados Pessoais (LGPD), Lei nº 13.709, de 14 de agosto de 2018 (LGPD), arts. 1º-10, 15-16, 23-32, 37-41, 46-47, 49-51 (general regime, principles, lawful basis, public-sector processing, agents and governance) Source as of privacy:br-lei-n-13-709-de-14-de-agosto-de-2018-lgpd:2

India

Connect all your ICT systems' clocks to the Network Time Protocol server of the National Informatics Centre or the National Physical Laboratory, or to an NTP server traceable to one of them, and ensure any other time source you use does not deviate from NPL or NIC.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Operator Hook Placing on the market; establishment of the manufacturer Runtime Outside any runtime path
CERT-In Cyber Security Directions, Incident Reporting, Logging and Time Synchronisation, Directions under section 70B(6) of the Information Technology Act, 2000, No. 20(3)/2022-CERT-In (Indian Computer Emergency Response Team, Ministry of Electronics and Information Technology, ) Source as of security:in-directions-under-70b-6-information-technology:1

Vietnam

Keep the system logs, data and information on the incident, and send the competent state agency a formal report on the remedy within 15 days of the preliminary report.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Decree implementing the AI Law, serious incident reporting and handling, Decree No. 142/2026/ND-CP, art. 19 Source as of ai:vn-decree-no-142-2026-nd-cp-19:4

Germany

If you are an essential or important entity under Section 28 of the BSI Act, base those measures on an all-hazards approach that covers at least risk analysis and security concepts, incident handling, business continuity, supply-chain security, security in acquisition, development and maintenance including vulnerability management and disclosure, effectiveness assessment, basic cyber hygiene and training, cryptography, personnel security and access control, and multi-factor or continuous authentication (Section 165(2a)); have your management implement and monitor them and take part in regular training (Section 165(2b) and (2d)).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator (entity in scope) Runtime not yet classified
Telekommunikationsgesetz (TKG), Section 165 Technical and Organisational Protective Measures, TKG § 165, Technische und organisatorische Schutzmaßnahmen Source as of security:de-tkg-165-technische-und-organisatorische-schut:2

Ireland

If you process personal data for health research in Ireland, take the safeguards listed in Regulation 3(1) of the Health Research Regulations 2018, including ethical approval of the research by a research ethics committee and controls to log who consulted, altered, disclosed or erased the personal data.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018, Safeguards and Explicit Consent for Health Research in Ireland, Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018 (S.I. No. 314 of 2018), regs. 3, 3A and 5, as amended by S.I. No. 18 of 2021 Source as of privacy:ie-data-protection-2018-36-2-health-research-reg:0

Italy

Allow access only to authorised persons, and record accesses and processing operations automatically in non-modifiable log files kept for five years (art. 10, comma 8).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), D.Lgs. 9 settembre 2026, n. 160, art. 10 Source as of ai:it-d-lgs-9-settembre-2026-n-160-10:5

Spain

If you are a health centre or individual practitioner holding the record of a deceased patient, give access only to persons connected to the patient for family or de facto reasons, unless the deceased prohibited it, and keep the clinical records under an active and diligent custody mechanism (Ley 41/2002, Articles 18(4) and 19).
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Ley 41/2002, Patient Right of Access to the Clinical Record and Active Custody of It in Spain, Ley 41/2002, de 14 de noviembre, arts. 18 and 19 Source as of privacy:es-ley-41-2002-de-14-de-noviembre-18-19:1

593 more lines in force under this theme, and 702 lines in all, are in the LexLint law library, each on the summary page of its instrument.

T12 · Testing & Red Teaming

The group's key concepts: Prompt injection; tool abuse; autonomy failures; adversarial testing; pre-deployment testing; test coverage; remediation

149 lines 142 in force 136 provisions 83 jurisdictions by type: mandatory obligation 105, conditional obligation 38, definition 3, recommendation/guidance 2, permission or exemption 1

Classes its lines carry: secure the system and the data in it (103), govern the system: policies, roles, assessments (72), report to a regulator (48), tell somebody when there is a breach (13); 5 from an instrument with no class recorded.

Sample requirement lines Show 13 of the 142 lines in forceHide the sample

What follows is a sample of 13 requirement lines from the LexLint law library, chosen to span jurisdictions.

European Union

Implement an IT strategy and arrangements for physical and electronic security that minimize the risks of attacks against your information systems, promptly inform the competent authority of any material breaches of your physical and electronic security measures with an incident report on the nature of the incident, the measures taken and the initiatives to avoid similar incidents, and annually undertake penetration tests and vulnerability scans (Article 18(1) to (4)).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), Directive 2014/65/EU, Article 17, supplemented by Commission Delegated Regulation (EU) 2017/589 Source as of ai:eu-2014-65-eu-17-supplemented-by-commission-dele:14

California

In that contract, reserve your right to take reasonable and appropriate steps to ensure consistent use and to stop and remediate unauthorized use, and require the service provider or contractor to tell you when it can no longer meet its obligations and to enable you to honor consumer requests (section 7051(a)(6) to (9)).
Type Conditional Obligation Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not yet classified Hook Residence of the data subject; establishment of the operator Runtime not yet classified
CCPA Regulations: contracts with service providers, contractors and third parties (article 4), Cal. Code Regs. tit. 11, sections 7050 to 7053 Source as of privacy:us-ca-cal-regs-tit-11-sections-7050-7053:1

Colorado

Establish a documented, risk-based governance and risk management framework, including a cross-functional governance group drawing on legal, compliance, risk management, product development, underwriting, actuarial, data science, marketing, and customer service, designed to determine through quantitative testing whether your use of an external consumer data and information source, or an algorithm or predictive model that uses one, results in unfair discrimination with respect to race, and to remediate any discrimination detected.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, 3 CCR 702-10, Regulation 10-1-1 Source as of ai:us-co-3-ccr-702-10-10-1-1:0

Texas

To rely on the defense that you found the violation yourself, discover it through feedback from a developer, deployer or other person who believes a violation has occurred, through testing including adversarial or red-team testing, through following guidelines set by applicable state agencies, or through an internal review process while you substantially comply with the most recent version of the National Institute of Standards and Technology's Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile or another nationally or internationally recognized AI risk management framework (s. 552.105(e)(2)).
Type Mandatory Obligation Modal imperative Binds, by its wording Deployer (the party that uses the system under its own authority) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
TRAIGA (H.B. 149, 2025), Attorney General enforcement, civil investigative demand, cure period, penalties and defenses, Tex. Bus. & Com. Code §§ 552.101-552.106 Source as of ai:us-tx-tex-bus-com-552-101-552-106:2

India

Conduct vulnerability assessment and penetration testing periodically for all critical and internet-facing systems: for critical information systems and systems in the demilitarised zone with a customer interface, vulnerability assessment at least once in every six months and penetration testing at least once in 12 months (paragraphs 149 to 151).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator (entity in scope) Runtime not yet classified
RBI Commercial Banks Cybersecurity Directions, Cybersecurity Policy, Testing and Security Operations Centre, Reserve Bank of India (Commercial Banks - Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, paras. 15, 149 to 153 and 212 to 216 Source as of security:in-reserve-bank-india-commercial-banks-cybersecu:2

Vietnam

If a serious incident occurs in your AI system and you are its deployer or user, record the incident, notify it promptly, and coordinate with the other parties during the remediation process.
Type Conditional Obligation Modal imperative Binds, by its wording Deployer (the party that uses the system under its own authority) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Law on Artificial Intelligence, incident management and reporting obligation, Law No. 134/2025/QH15, art. 12 Source as of ai:vn-no-134-2025-qh15-12:1

Australia

Notify APRA as soon as possible and, in any case, no later than 10 business days, after becoming aware of a material information security control weakness that you expect you will not be able to remediate in a timely manner (paragraph 36).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Placing on the market; establishment of the manufacturer Runtime not yet classified
Prudential Standard CPS 234 Information Security, Notification to APRA, Prudential Standard CPS 234 Information Security (APRA), paras 35 and 36; Banking Act 1959 (Cth), s. 11AG Source as of security:au-prudential-standard-cps-234-information-sec-2:2

New York

Do penetration testing at least annually by a qualified internal or external party, scan for publicly known vulnerabilities, and remediate vulnerabilities in a timely way based on the risk they pose (subdivision (f)).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator (entity in scope) Runtime not yet classified
Hospital Cybersecurity Requirements, cybersecurity program, policy, testing and incident response plan, 10 NYCRR 405.46(c) to (m) Source as of security:us-ny-10-nycrr-405-46-c-m:3

South Africa

Give the SARB regular updates, and further details once the incident has been remediated and operations have resumed (para. 5.2.2).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Placing on the market; establishment of the manufacturer Runtime not yet classified
SARB Directive on Cyber-Incident Reporting within the National Payment System, Directive No. 01 of 2024 (SARB), cyber-incident reporting within the national payment system, para. 5.2 Source as of security:za-no-01-2024-sarb-cyber-incident-reporting-with:3

Nigeria

Introduce logical access controls in the technology infrastructure deployed and test them using periodic penetration testing. Establish a resilient framework for periodic data backup and recovery, business continuity and data and software management (paragraphs 9.1.5 and 9.1.6). Allow only authorized staff to update information on your website or other channels, subject critical updates to dual verification and two-step authentication, and document the maintenance evidence to the Commission on or before January 31 of the succeeding year (paragraph 9.1.3).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
National Insurance Commission Guidelines for Insurtech Operations in Nigeria, licensing, technology security, lead management and limits on automated claims rejection, Guidelines for Insurtech Operations in Nigeria, August 2025 Source as of ai:ng-guidelines-insurtech-operations-in-nigeria-au:2

Kenya

Run vulnerability assessment, risk assessment and penetration testing of your systems on a bi-annual basis during the first year of licensing and at least once a year afterwards, and keep audit trail systems that protect the integrity of the data and hardware they record and log cybersecurity events (regulation 97(4)).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator (entity in scope) Runtime not yet classified
Virtual Asset Service Providers Regulations, Cybersecurity Systems, Controls and Continuity Plans, Virtual Asset Service Providers Regulations, 2026 (Legal Notice No. 134 of 2026), regs. 18, 21, 96, 97 and 100 Source as of security:ke-virtual-asset-service-providers-regulations-2:5

United States

Develop pre-deployment testing and risk mitigation plans for a high-impact use case that reflect expected real-world outcomes; where you lack access to the underlying AI source code, models or data, use alternative test methodologies such as querying the AI service and observing the outputs, or giving the vendor evaluation data and obtaining results (Section 4(b)(i)).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
OMB Memorandum M-25-21, Accelerating Federal Use of Artificial Intelligence through Innovation, Governance, and Public Trust, OMB Memorandum M-25-21 () Source as of ai:us-omb-memorandum-m-25-21-april-3-2025:6

United Arab Emirates

Monitor the performance of your models on a regular basis, present monitoring reports to the Model Oversight Committee at least every quarter, and follow a clear process in which that Committee decides whether to continue using a model with further monitoring or to suspend it and work on remediation (Sections 3.6.1, 3.6.4 and 3.6.7).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Model Management Standards: governance, validation and monitoring of the models a bank uses to decide, including artificial intelligence models, Model Management Standards Source as of ai:ae-model-management-standards:4

129 more lines in force under this theme, and 149 lines in all, are in the LexLint law library, each on the summary page of its instrument.

T13 · Third-Party & Supply Chain

The group's key concepts: Vendor due diligence; model provenance; tool vetting; AI BOM; SLA; supply chain risk; third-party incident notification

2,916 lines 2,644 in force 1,512 provisions 264 jurisdictions by type: mandatory obligation 1,231, conditional obligation 1,086, prohibition 369, definition 144, permission or exemption 41, recommendation/guidance 31, consequence (penalty or remedy) 14

Classes its lines carry: secure the system and the data in it (1,154), govern the system: policies, roles, assessments (916), disclose the use of AI (648), get consent first (615); 334 from an instrument with no class recorded.

Sample requirement lines Show 13 of the 2,644 lines in forceHide the sample

What follows is a sample of 13 requirement lines from the LexLint law library, chosen to span jurisdictions.

European Union

It reaches you if you are an investment firm, meaning a legal person whose regular occupation or business is the provision of one or more investment services to third parties and/or the performance of one or more investment activities on a professional basis (Directive 2014/65/EU, Article 4(1), point (1)): arrange for records to be kept of all services, activities and transactions undertaken by you, sufficient to enable the competent authority to fulfil its supervisory tasks and to perform the enforcement actions under the Directive, Regulation (EU) No 600/2014, Directive 2014/57/EU and Regulation (EU) No 596/2014, and in particular to ascertain that you have complied with all obligations, including those with respect to clients or potential clients and to the integrity of the market (Article 16(6)).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
MiFID II and MiFIR Records of Services, Activities, Orders and Transactions (Article 16(6) and MiFIR Article 25), Directive 2014/65/EU, Article 16(6), with Regulation (EU) No 600/2014, Article 25(1) Source as of ai:eu-2014-65-eu-16-6-with-eu-no-600-2014-25-1:1

California

If you use automated decisionmaking technology (ADMT) to make a significant decision about a consumer (granting or denying financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, or healthcare services), give the consumer a Pre-use Notice describing that use and the consumer's rights to opt out of and access information about it
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
CCPA Automated Decisionmaking Technology Regulations, Cal. Code Regs. tit. 11, Sections 7200 to 7222 Source as of ai:us-ca-11-cal-regs-sections-7200-7222:0

Colorado

Make every component of your governance and risk management framework available to the Division on request, as of December 1 each year if you are a life insurer and as of July 1 each year if you are a private passenger automobile or health benefit plan insurer.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, 3 CCR 702-10, Regulation 10-1-1 Source as of ai:us-co-3-ccr-702-10-10-1-1:4

Texas

If you are a health care practitioner using AI for diagnostic purposes, including AI-generated recommendations on a diagnosis or course of treatment, stay within the scope of your license, do not use AI in a way state or federal law otherwise restricts, and review all AI-created records consistent with Texas Medical Board standards.
Type Conditional Obligation Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Outside any runtime path
S.B. 1188 (2025), AI diagnostic disclosure duty in electronic health records, Tex. Health & Safety Code § 183.005 Source as of ai:us-tx-tex-health-safety-183-005:0

South Korea

Establish and carry out a plan to explain, so far as technically feasible, your AI's final output, the main criteria it used to reach that output, and an overview of the training data you used to develop or use it.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
AI Framework Act, Article 34 (business-operator duties for high-impact AI), Act No. 20676, Article 34 Source as of ai:kr-no-20676-34:2

United Kingdom

Rely on the text and data analysis exception only where you have lawful access to the work and the copy is made so that a person with lawful access can carry out a computational analysis of what the work records for the sole purpose of research for a non-commercial purpose.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Copies for Text and Data Analysis for Non-Commercial Research (Copyright, Designs and Patents Act 1988, s. 29A), Copyright, Designs and Patents Act 1988, c. 48, s. 29A Source as of ai:gb-copyright-designs-patents-1988-c-48-s-29a:0

Brazil

Take consent only when it is provided in writing or by another means demonstrating the data subject's free will, in a clause set apart from the other contract terms, and be ready to prove it meets these requirements.
Type Definition Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Lei Geral de Proteção de Dados Pessoais (LGPD), Lei nº 13.709, de 14 de agosto de 2018 (LGPD), arts. 1º-10, 15-16, 23-32, 37-41, 46-47, 49-51 (general regime, principles, lawful basis, public-sector processing, agents and governance) Source as of privacy:br-lei-n-13-709-de-14-de-agosto-de-2018-lgpd:1

India

Embed synthetically generated information with permanent metadata or another technical provenance mechanism, including a unique identifier, to the extent technically feasible, and do not enable removal, suppression or modification of that label or metadata.
Type Conditional Obligation Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Where the output is used; placing on the market Runtime Detectable at a runtime control
Synthetically Generated Information Labelling Duty for Intermediaries, Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, rule 3(3), as inserted by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (G.S.R. 120(E), dated ) Source as of ai:in-information-technology-intermediary-guideline:1

Vietnam

During an inspection or examination of your AI activity in Vietnam, provide the inspecting authority with technical dossiers, trace logs, training data and other necessary information needed to determine the cause of a violation or incident or to apportion responsibility.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Law on Artificial Intelligence, inspection and examination, Law No. 134/2025/QH15, art. 28 Source as of ai:vn-no-134-2025-qh15-28:0

Germany

If you are a private body, you need not give that Article 14 information where giving it would impair the assertion, exercise or defense of civil-law claims, or where the processing contains data from civil-law contracts and serves to prevent damage from crimes, unless the person's legitimate interest in being informed outweighs yours, or where the competent public authority has found that disclosure would endanger public security or order or otherwise harm the Federation or a Land, under BDSG Section 33(1) number 2.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
BDSG Sections 32, 33 and 36, Limits on the Duty to Inform and the Right to Object in Germany, Bundesdatenschutzgesetz (BDSG) §§ 32, 33, 36 Source as of privacy:de-bundesdatenschutzgesetz-bdsg-32-33-36:4

Ireland

Where a decision based solely on automated processing about a person in Ireland rests on a contract with them or on their explicit consent, put suitable safeguards in place, at least the right to obtain human intervention, to express their point of view and to contest the decision, under GDPR Article 22(3).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject Runtime reworded since it was classified
GDPR Article 22 and Data Protection Act 2018 Section 57, Automated Decision-Making in Ireland, Regulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22; Data Protection Act 2018, s. 57 Source as of privacy:ie-eu-2016-679-22-as-transposed-by-data-protecti:0

Italy

If you operate a place or organise an event with particular public-order and security needs, you may install and maintain the AI components and biometric technologies at no new or greater cost to public finances, and the systems are then lent free of charge to the questura, which has their complete and exclusive use (art. 10, comma 13).
Type Conditional Obligation Modal may Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), D.Lgs. 9 settembre 2026, n. 160, art. 10 Source as of ai:it-d-lgs-9-settembre-2026-n-160-10:7

Spain

If you are a trader making an offer to consumers individually, personalised on the basis of automated decision-making, inform them of the parameters used for the personalisation and, for offers on contracts for financial products or services, of the data sources used (Ley 3/1991, article 27, paragraph 9).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Where the output is used; placing on the market Runtime not yet classified
Ley 10/2025 Final Provisions 1 and 3, Disclosure of Automated Personalisation of Offers and Prices to Consumers, Ley 10/2025, de 26 de diciembre, disposiciones finales primera y tercera (BOE-A-2025-26698), art. 27.9 Ley 3/1991 y art. 20.1.c del texto refundido de la Ley General para la Defensa de los Consumidores y Usuarios Source as of ai:es-ley-10-2025-de-26-de-diciembre-disposiciones:0

2,631 more lines in force under this theme, and 2,916 lines in all, are in the LexLint law library, each on the summary page of its instrument.

T14 · Incident Response

The group's key concepts: Detection; containment; incident classification; regulatory notification; root cause analysis; recovery; post-incident review

2,585 lines 2,376 in force 1,102 provisions 244 jurisdictions by type: mandatory obligation 1,311, conditional obligation 1,044, prohibition 90, definition 62, recommendation/guidance 37, consequence (penalty or remedy) 37, permission or exemption 4

Classes its lines carry: report to a regulator (1,413), secure the system and the data in it (973), tell somebody when there is a breach (657), govern the system: policies, roles, assessments (505); 367 from an instrument with no class recorded.

Sample requirement lines Show 13 of the 2,376 lines in forceHide the sample

What follows is a sample of 13 requirement lines from the LexLint law library, chosen to span jurisdictions.

European Union

Have business continuity arrangements for your algorithmic trading systems that are appropriate to the nature, scale and complexity of your business and documented in a durable medium, that deal with disruptive incidents and ensure a timely resumption of algorithmic trading, and review and test them annually (Article 14(1), (2) and (4)).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), Directive 2014/65/EU, Article 17, supplemented by Commission Delegated Regulation (EU) 2017/589 Source as of ai:eu-2014-65-eu-17-supplemented-by-commission-dele:11

California

If you are a frontier developer, report a critical safety incident pertaining to one or more of your frontier models to the Office of Emergency Services within 15 days of discovering it; if you discover information about the incident after filing, you may file an amended report (Section 22757.13(c))
Type Conditional Obligation Modal may Binds, by its wording Developer, distributor or importer Scope turns on reworded since it was classified Hook Establishment of the operator; placing on the market; where the output is used Runtime reworded since it was classified
Transparency in Frontier Artificial Intelligence Act (SB 53), Cal. Bus. and Prof. Code Sections 22757.10 to 22757.16 Source as of ai:us-ca-cal-bus-prof-sections-22757-10-22757-16:5

Colorado

If you experience unauthorized acquisition of unencrypted computerized personal information of Colorado residents, notify affected residents without unreasonable delay and within 30 days of determining a breach occurred.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the affected person Runtime Evidenced by the runtime's record
C.R.S. 6-1-716, Notification of Security Breach, C.R.S. section 6-1-716 Source as of privacy:us-co-c-r-s-6-1-716:0

Texas

If you own a website, application, or social media platform on which such material is disclosed, you are liable for damages if the depicted person requests removal and you fail to remove it, and known identical copies, within 72 hours.
Type Conditional Obligation Modal imperative Binds, by its wording Platform or intermediary Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Outside any runtime path
S.B. 441 (2025), civil liability for artificial intimate visual material and nudification applications, Tex. Civ. Prac. & Rem. Code §§ 98B.0021-98B.009 Source as of ai:us-tx-tex-civ-prac-rem-98b-0021-98b-009:2

South Korea

Notify users when content they see was produced by generative AI
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Where the output is used; placing on the market Runtime Detectable at a runtime control
AI Framework Act, Article 31 (transparency obligations for AI outputs), Act No. 20676, Article 31 Source as of ai:kr-no-20676-31:0

United Kingdom

Any authorization may carry conditions set in the regulations or by the Secretary of State, may be varied, suspended or withdrawn, and may be subject to fees, and the regulations may create fine-only offenses for breach of a condition.
Type Conditional Obligation Modal may, subject to Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Authorized Technology Testing Defense for Obscenity and Child Abuse Image Offenses (Regulation-Making Power), Crime and Policing Act 2026, c. 20, ss. 111-112 (obscenity etc offences: technology testing defence) Source as of ai:gb-crime-policing-2026-c-20-ss-111-112-obscenity:2

Brazil

Do not publish, republish or pay to boost new synthetic content produced or altered by AI or equivalent technology that uses the image, voice or statement of a candidate or a public figure, even where labeled, from 72 hours before to 24 hours after the end of the election.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Where the output is used; placing on the market Runtime not yet classified
TSE Resolution, AI-Generated Content Disclosure Duty, Resolução TSE nº 23.610/2019, art. 9º-B (redação dada pela Resolução TSE nº 23.732, de 27 de fevereiro de 2024) Source as of ai:br-resolu-o-tse-n-23-610-2019-9-b-reda-o-dada-pe:3

India

The Digital Personal Data Protection Rules, 2025 are only partly in force: today, only the Data Protection Board's own administrative machinery rules apply. Once fully in force (Rule 4 on , and the remaining app-facing rules, including consent-notice form, breach notification, and Significant Data Fiduciary duties, on ), an app processing Indian personal data, including a biometric identifier, must follow the notified consent-notice, security-safeguard, and breach-notification detail these Rules set.
Type Definition Modal may, must Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook Residence of the data subject; establishment of the operator Runtime not a duty
Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), Digital Personal Data Protection Rules, 2025, notified Source as of privacy:in-g-s-r-846-e-digital-personal-data-protection:0

Vietnam

As a deployer or user, record a serious incident promptly, take the measures needed to limit its consequences and notify the provider; as a provider, apply the technical measures needed to prevent, limit and remedy it.
Type Mandatory Obligation Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Decree implementing the AI Law, serious incident reporting and handling, Decree No. 142/2026/ND-CP, art. 19 Source as of ai:vn-decree-no-142-2026-nd-cp-19:0

Germany

Notify the competent data protection authority without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Germany, unless the breach is unlikely to risk their rights and freedoms.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the affected person Runtime reworded since it was classified
GDPR Articles 33-34, Breach Notification in Germany, Regulation (EU) 2016/679, Arts. 33-34 Source as of privacy:de-eu-2016-679-33-34:0

Ireland

Notify the Data Protection Commission without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Ireland, unless the breach is unlikely to risk their rights and freedoms.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the affected person Runtime Evidenced by the runtime's record
GDPR Articles 33-34, Breach Notification in Ireland, Regulation (EU) 2016/679, Arts. 33-34 Source as of privacy:ie-eu-2016-679-33-34:0

Italy

Adopt the technical safety measures provided for the design, training, production and placing on the market of high-risk AI systems, suited to prevent malfunctions or alterations of how the systems work, and adopt human-oversight measures, where omitting them would endanger life or public or individual safety, or the security of the State (Codice Penale art. 437-bis, first paragraph).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Codice Penale, art. 437-bis, inserted by D.Lgs. 9 settembre 2026, n. 160, art. 12 Source as of ai:it-codice-penale-437-bis-inserted-by-d-lgs-9-set:0

Spain

Notify the AEPD without undue delay and, where feasible, within 72 hours of becoming aware of a personal-data breach affecting a person in Spain, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the affected person Runtime reworded since it was classified
GDPR Articles 33-34 and LOPDGDD Articles 73(r)-(s) and 74(m)-(n), Breach Notification, Regulation (EU) 2016/679, Arts. 33-34; LOPDGDD, Art. 73(r)-(s), Art. 74(m)-(n) Source as of privacy:es-eu-2016-679-33-34-lopdgdd-69-73-r-s:0

2,363 more lines in force under this theme, and 2,585 lines in all, are in the LexLint law library, each on the summary page of its instrument.

T15 · Transparency & User Disclosure

The group's key concepts: AI disclosure; user notices; explanations; user expectations; consent; labeling; deception prohibition; capability limits

7,182 lines 6,354 in force 2,613 provisions 266 jurisdictions by type: mandatory obligation 3,175, conditional obligation 2,478, prohibition 1,005, definition 285, consequence (penalty or remedy) 84, permission or exemption 84, recommendation/guidance 71

Classes its lines carry: disclose the use of AI (2,825), secure the system and the data in it (2,436), govern the system: policies, roles, assessments (1,933), get consent first (1,547); 797 from an instrument with no class recorded.

Sample requirement lines Show 13 of the 6,354 lines in forceHide the sample

What follows is a sample of 13 requirement lines from the LexLint law library, chosen to span jurisdictions.

European Union

Have robust governance arrangements, which include a clear organizational structure with well-defined, transparent and consistent lines of responsibility (Article 74(1), point (a)).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Capital Requirements Directive, Robust Governance Arrangements of Institutions (Article 74(1)), Directive 2013/36/EU, Article 74(1) Source as of ai:eu-2013-36-eu-74-1:2

California

If you use automated decisionmaking technology (ADMT) to make a significant decision about a consumer (granting or denying financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, or healthcare services), give the consumer a Pre-use Notice describing that use and the consumer's rights to opt out of and access information about it
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
CCPA Automated Decisionmaking Technology Regulations, Cal. Code Regs. tit. 11, Sections 7200 to 7222 Source as of ai:us-ca-11-cal-regs-sections-7200-7222:0

Colorado

Establish a documented, risk-based governance and risk management framework, including a cross-functional governance group drawing on legal, compliance, risk management, product development, underwriting, actuarial, data science, marketing, and customer service, designed to determine through quantitative testing whether your use of an external consumer data and information source, or an algorithm or predictive model that uses one, results in unfair discrimination with respect to race, and to remediate any discrimination detected.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, 3 CCR 702-10, Regulation 10-1-1 Source as of ai:us-co-3-ccr-702-10-10-1-1:0

Texas

If you are a governmental agency making an AI system available to interact with consumers, disclose before or at the time of interaction that the consumer is interacting with an AI system, even if that would already be obvious to a reasonable consumer.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Where the output is used; placing on the market Runtime Detectable at a runtime control
TRAIGA (H.B. 149, 2025), consumer AI-interaction disclosure duty, Tex. Bus. & Com. Code § 552.051 Source as of ai:us-tx-tex-bus-com-552-051:0

South Korea

Check the Enforcement Decree for labeling specifics as they phase in
Type Definition Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook Where the output is used; placing on the market Runtime not a duty
AI Framework Act, Article 31 (transparency obligations for AI outputs), Act No. 20676, Article 31 Source as of ai:kr-no-20676-31:1

United Kingdom

It reaches you if you operate as a creditor under a prospective regulated agreement, meaning the person providing credit under a consumer credit agreement, including the prospective creditor, where the agreement is a regulated agreement and is not an excluded agreement (a consumer hire agreement or an agreement secured on land): when you decide not to proceed with it on the basis of information you obtained from a credit reference agency, inform the debtor, when telling the debtor of the decision, that the decision was reached on the basis of information from a credit reference agency, and provide the debtor with the particulars of the agency, including its name, address and telephone number (Consumer Credit Act 1974, section 157(A1), (4); section 189).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Consumer Credit Act 1974, duty to tell a refused applicant that a credit reference agency was used and to give its name and address, Consumer Credit Act 1974, c. 39, s. 157 Source as of ai:gb-consumer-credit-1974-c-39-s-157:0

Brazil

Disclose, explicitly, prominently, and accessibly, when electoral advertising uses synthetic content generated by AI or equivalent technology to create, replace, omit, merge, alter the speed of, or overlay images or sounds, and name the technology used.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Where the output is used; placing on the market Runtime reworded since it was classified
TSE Resolution, AI-Generated Content Disclosure Duty, Resolução TSE nº 23.610/2019, art. 9º-B (redação dada pela Resolução TSE nº 23.732, de 27 de fevereiro de 2024) Source as of ai:br-resolu-o-tse-n-23-610-2019-9-b-reda-o-dada-pe:0

India

If you operate a computer resource that may enable the creation, generation, modification, alteration, publication, transmission, sharing or dissemination of synthetically generated information, prominently label such information, in the visual display or by a prefixed audio disclosure, so a viewer can immediately identify it as synthetically generated.
Type Conditional Obligation Modal may Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Where the output is used; placing on the market Runtime Detectable at a runtime control
Synthetically Generated Information Labelling Duty for Intermediaries, Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, rule 3(3), as inserted by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (G.S.R. 120(E), dated ) Source as of ai:in-information-technology-intermediary-guideline:0

Vietnam

Give information on your AI system's purpose of use, scope, conditions of use and limits, keep the information and documents needed for inspection and supervision, and explain yourself when the competent state agency asks in writing.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Where the output is used; placing on the market Runtime not yet classified
Decree implementing the AI Law, transparency, technical marking and labeling of AI-generated content, Decree No. 142/2026/ND-CP, arts. 16-18 Source as of ai:vn-decree-no-142-2026-nd-cp-16-18:0

Germany

If you are a private-sector employer with a works council, inform the works council in good time, with the necessary documents, about the planned use of artificial intelligence in work procedures and work flows (Betriebsverfassungsgesetz, section 90(1), point 3).
Type Conditional Obligation Modal imperative Binds, by its wording Employer Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Betriebsverfassungsgesetz (BetrVG) Sections 80(3), 90(1) No. 3 and 95(2a), Works Council Rights on the Use of Artificial Intelligence, Betriebsverfassungsgesetz (BetrVG), §§ 80 Abs. 3, 90 Abs. 1 Nr. 3 and 95 Abs. 2a Source as of ai:de-betriebsverfassungsgesetz-betrvg-80-abs-3-90:0

Ireland

Comply with information requests, contravention notices and prohibition notices issued by an authorised officer of a relevant market surveillance authority in respect of an AI system you provide or deploy (Part 5).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Operator Hook Establishment of the operator; placing on the market; where the output is used Runtime Outside any runtime path
Regulation of Artificial Intelligence Act 2026, Regulation of Artificial Intelligence Act 2026 (No. 31 of 2026) Source as of ai:ie-regulation-of-artificial-intelligence-2026:0

Italy

Do not transfer, publish, or otherwise disseminate a falsified or altered image, video, or voice recording generated using an AI system, capable of misleading others as to its genuineness, without the depicted or recorded person's consent.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
Codice Penale Art. 612-quater, Illicit Dissemination of AI-Generated or AI-Altered Content, Codice Penale, art. 612-quater, inserted by Legge 23 settembre 2025, n. 132, art. 26, comma 1, lettera c) Source as of ai:it-cp-612quater-ai-deepfake-dissemination:0

Spain

If you are a trader making an offer to consumers individually, personalised on the basis of automated decision-making, inform them of the parameters used for the personalisation and, for offers on contracts for financial products or services, of the data sources used (Ley 3/1991, article 27, paragraph 9).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Where the output is used; placing on the market Runtime not yet classified
Ley 10/2025 Final Provisions 1 and 3, Disclosure of Automated Personalisation of Offers and Prices to Consumers, Ley 10/2025, de 26 de diciembre, disposiciones finales primera y tercera (BOE-A-2025-26698), art. 27.9 Ley 3/1991 y art. 20.1.c del texto refundido de la Ley General para la Defensa de los Consumidores y Usuarios Source as of ai:es-ley-10-2025-de-26-de-diciembre-disposiciones:0

6,341 more lines in force under this theme, and 7,182 lines in all, are in the LexLint law library, each on the summary page of its instrument.

T16 · Recordkeeping & Auditability

The group's key concepts: Retention schedules; reproducibility; audit readiness; record integrity; regulatory reporting; archival; destruction

7,814 lines 6,981 in force 1,989 provisions 269 jurisdictions by type: mandatory obligation 4,161, conditional obligation 2,593, prohibition 577, definition 254, recommendation/guidance 112, permission or exemption 60, consequence (penalty or remedy) 57

Classes its lines carry: govern the system: policies, roles, assessments (4,309), secure the system and the data in it (3,906), report to a regulator (3,078), disclose the use of AI (1,277); 228 from an instrument with no class recorded.

Sample requirement lines Show 13 of the 6,981 lines in forceHide the sample

What follows is a sample of 13 requirement lines from the LexLint law library, chosen to span jurisdictions.

European Union

This Directive is addressed to the Member States (Article 165), which had to adopt and publish the measures necessary to comply with it by and apply them from (Article 162(1)), so an institution meets these rules through each Member State's national law; Article 74(1) in the wording that Directive (EU) 2024/1619 gave it applies from (Article 2(1) of that Directive).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Capital Requirements Directive, Robust Governance Arrangements of Institutions (Article 74(1)), Directive 2013/36/EU, Article 74(1) Source as of ai:eu-2013-36-eu-74-1:0

California

If a reasonable person interacting with your companion chatbot could be misled into believing they are talking to a human, issue a clear and conspicuous notification that the chatbot is artificially generated and not human
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Where the output is used; placing on the market Runtime Detectable at a runtime control
Companion Chatbot Safety and Accountability Act (SB 243), Cal. Bus. and Prof. Code Sections 22601 to 22606 Source as of ai:us-ca-cal-bus-prof-sections-22601-22606:0

Colorado

Establish a documented, risk-based governance and risk management framework, including a cross-functional governance group drawing on legal, compliance, risk management, product development, underwriting, actuarial, data science, marketing, and customer service, designed to determine through quantitative testing whether your use of an external consumer data and information source, or an algorithm or predictive model that uses one, results in unfair discrimination with respect to race, and to remediate any discrimination detected.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, 3 CCR 702-10, Regulation 10-1-1 Source as of ai:us-co-3-ccr-702-10-10-1-1:0

Texas

If the Attorney General notifies you in writing of a violation, cure it within 60 days of the notice and give the Attorney General a written statement that you have cured the violation, supporting documentation showing the manner in which you cured it, and a statement that you have made any necessary changes to internal policies to reasonably prevent further violation (s. 552.104(b)).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
TRAIGA (H.B. 149, 2025), Attorney General enforcement, civil investigative demand, cure period, penalties and defenses, Tex. Bus. & Com. Code §§ 552.101-552.106 Source as of ai:us-tx-tex-bus-com-552-101-552-106:0

South Korea

If your AI system was trained using cumulative compute of 10^26 floating-point operations or more, applies the most advanced AI technology currently in use, and could broadly and seriously affect people's life, physical safety or fundamental rights, identify, assess and mitigate risk across the system's full life cycle.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
AI Framework Act, Article 32 (safety-assurance duty for high-compute AI systems), Act No. 20676, Article 32 Source as of ai:kr-no-20676-32:0

United Kingdom

It reaches you if you are a firm that makes a personal recommendation to a retail client in relation to a designated investment, manages investments of a retail client of the firm, or manages the assets of an occupational pension scheme, stakeholder pension scheme or personal pension scheme, other than in relation to your MiFID, equivalent third country or optional exemption business or an insurance-based investment product, for which COBS 9A sets the suitability rules (COBS 9.1.1R and COBS 9.1.1AG), and not in relation to a targeted support service within the scope of COBS 9B (COBS 9.1.1BG): take reasonable steps to ensure that a personal recommendation, or a decision to trade, is suitable for your client, and ensure that any life policy proposed is consistent with the client's insurance demands and needs (COBS 9.2.1R(1)).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Suitability for business that is not MiFID business: personal recommendations to retail clients and decisions to trade for them (COBS 9.1 and 9.2), FCA Handbook, COBS 9 Source as of ai:gb-fca-handbook-cobs-9:0

Brazil

Establish a lawful basis under article 7 before processing personal data, including data the person has made public.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
Lei Geral de Proteção de Dados Pessoais (LGPD), Lei nº 13.709, de 14 de agosto de 2018 (LGPD), arts. 1º-10, 15-16, 23-32, 37-41, 46-47, 49-51 (general regime, principles, lawful basis, public-sector processing, agents and governance) Source as of privacy:br-lei-n-13-709-de-14-de-agosto-de-2018-lgpd:0

India

Get the rights holder's authorisation before reproducing or reusing copyrighted material, including a copyrighted database or compilation, to train an AI model; the fair-dealing exceptions do not name text-and-data-mining or AI training as a covered purpose.
Type Mandatory Obligation Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime Enforceable at a runtime control
Copyright Act, No Text-and-Data-Mining Exception, Database Compilations, and Technological Protection Measures, Copyright Act, 1957 (No. 14 of 1957), ss. 2(o), 51, 52, 63, 65A Source as of scraping:in-copyright-1957-no-14-1957-ss-2-o-51-52-63-65a:0

Vietnam

Classify your AI system's risk level (high, medium or low) before putting it into use, and answer for the accuracy of the result.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Decree implementing the AI Law, risk classification, notification, conformity assessment and risk management, Decree No. 142/2026/ND-CP, arts. 6, 9, 11-15 Source as of ai:vn-decree-no-142-2026-nd-cp-6-9-11-15:0

Germany

Provide the information or documentation, and give the access, that Article 21 requires of a provider of a high-risk AI system when a competent authority asks; carry out and update the fundamental rights impact assessment Article 27 requires and send the notification it requires; if you are a notified body, inform the notifying authority as Article 45 requires; and, if you operate a high-risk AI system under point 1, 3, 4 or 5 of Annex III, give an affected person the explanation Article 86 requires (Section 15).
Type Conditional Obligation Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on reworded since it was classified Hook Establishment of the operator; placing on the market; where the output is used Runtime reworded since it was classified
Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-Marktüberwachungs-und-Innovationsförderungs-Gesetz, KI-MIG), §§ 2, 6, 8, 13, 15, 16, 20 Source as of ai:de-gesetz-zur-markt-berwachung-und-innovationsf:0

Ireland

If you process personal data for health research in Ireland, take the safeguards listed in Regulation 3(1) of the Health Research Regulations 2018, including ethical approval of the research by a research ethics committee and controls to log who consulted, altered, disclosed or erased the personal data.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018, Safeguards and Explicit Consent for Health Research in Ireland, Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018 (S.I. No. 314 of 2018), regs. 3, 3A and 5, as amended by S.I. No. 18 of 2021 Source as of privacy:ie-data-protection-2018-36-2-health-research-reg:0

Italy

Adopt the technical safety measures provided for the design, training, production and placing on the market of high-risk AI systems, suited to prevent malfunctions or alterations of how the systems work, and adopt human-oversight measures, where omitting them would endanger life or public or individual safety, or the security of the State (Codice Penale art. 437-bis, first paragraph).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Codice Penale, art. 437-bis, inserted by D.Lgs. 9 settembre 2026, n. 160, art. 12 Source as of ai:it-codice-penale-437-bis-inserted-by-d-lgs-9-set:0

Spain

Compensate any person in Spain who suffered material or non-material damage from your infringement, as controller or processor, under GDPR Article 82.
Type Mandatory Obligation Modal imperative Binds, by its wording Controller (the party that decides why and how personal data is processed) Scope turns on reworded since it was classified Hook Establishment of the operator Runtime reworded since it was classified
AEPD Enforcement, GDPR Article 82 and LOPDGDD Título IX, Regulation (EU) 2016/679, Arts. 82-83; LOPDGDD, Art. 47, Arts. 70-78 Source as of privacy:es-eu-2016-679-82-83-lopdgdd-47-70-78:0

6,968 more lines in force under this theme, and 7,814 lines in all, are in the LexLint law library, each on the summary page of its instrument.

3A sample of the register as a file

theme-register.csv is a sample of the register: the lines of European Union law that fall under at least one theme, one row per line, with the theme identifiers each belongs to, the columns above, and the topic, instrument, citation, summary page, source, lifecycle band and as-of date. The counts on this page cover every line; every other line is on the summary page of its instrument. To discuss the whole register as a file, contact LexLint at hello@ungovr.org. It is generated from the LexLint law library on the date in this page's byline and it will be regenerated when the law library moves; a copy taken today is a snapshot with that date on it.

Two links per row. Instrument page is LexLint's own summary of the instrument. Source URL, after it, is the link the LexLint law library researched the instrument from: for most rows the law's own text at its publisher (a gazette, a legislature, a regulator) or in a repository of legal texts such as WIPO Lex or an archived copy, and for a few rows the secondary source the research read, which is why the column is named for the source rather than for the law.

Classification. A Classification column after the runtime tier says which of four states the line is in: classified, not a duty, not yet classified, or reworded since it was classified. The party, party group and tier columns print the same words in place of a value for every line in the other three states, so a blank never has to be guessed at.

Party group. Party group (LexLint six parties), after the party column, restates the party whose position triggers scope as one of The 6 parties, so a row can be read against that document, by the mapping below. A line with no party has no group.

Party whose position triggers scopeParty group
OperatorOPERATOR
PrincipalUSER
ProviderMAKER
CounterpartyCOUNTERPARTY
Affected personUSER
Data subjectUSER

The theme columns are this page's, not the law library's: the law library records obligation classes and wording, and the mapping from those to the sixteen themes is the rule stated in section 1 and printed on the page before this one. The same lines with the classes and without the theme columns are the handbook's file, described in the requirement register. The file is licensed separately from the text and figures around it, under Creative Commons Attribution 4.0 rather than the ShareAlike terms in the byline: use it for any purpose, including commercially, with credit to LexLint (UnGovr).