Law / Frameworks

Governance frameworks, read against the law

A governance framework lists the controls to run. Each page here turns one around: under every control, the laws we track that bear on it and the jurisdictions that made them.

Map one framework to another, through the laws whose duties reach both.

What changed in the frameworks: each one read against the law, and each draft and final edition its publisher released, by day.

AI governance

Framework	Controls with law	Laws	Jurisdictions	Laws naming it	What we print
NIST AI Risk Management FrameworkNational Institute of Standards and Technology, version 1.0, January 2023 (NIST AI 100-1) 50 of 72 controls with law, 1,141 laws	50 of 72	1,141	263	2	Full text, public domain (a US government work)
NIST Generative AI ProfileNational Institute of Standards and Technology, July 2024 (NIST AI 600-1) 8 of 12 controls with law, 557 laws	8 of 12	557	198	none	Full text, public domain (a US government work)
OWASP Top 10 for LLM ApplicationsOWASP GenAI Security Project, 2026 edition, August 2026 5 of 10 controls with law, 227 laws	5 of 10	227	130	none	Excerpts, CC BY-SA 4.0
OWASP Top 10 for Agentic ApplicationsOWASP GenAI Security Project, 2026 edition, December 2025 4 of 10 controls with law, 281 laws	4 of 10	281	145	none	Excerpts, CC BY-SA 4.0
FINOS AI Governance FrameworkFINOS, version 2, as maintained on October 7, 2026 16 of 25 controls with law, 1,597 laws	16 of 25	1,597	246	none	Full text, CC BY 4.0
ETSI EN 304 223, Baseline Cyber Security Requirements for AI Models and SystemsEuropean Telecommunications Standards Institute (ETSI), version 2.1.1, December 2025 20 of 72 controls with law, 504 laws	20 of 72	504	193	none	Provision numbers, with our own summaries, ETSI's copyright; we print numbers only

Privacy

Framework	Where the law lands	Controls with law	Laws	Jurisdictions	Laws naming it	What we print
NIST Privacy FrameworkNational Institute of Standards and Technology, version 1.0, January 2020 79 of 100 controls with law, 1,804 laws		79 of 100	1,804	242	1	Full text, public domain (a US government work)

Security

Framework	Controls with law	Laws	Jurisdictions	Laws naming it	What we print
NIST Cybersecurity FrameworkNational Institute of Standards and Technology, version 2.0, February 2024 (NIST CSWP 29) 79 of 106 controls with law, 526 laws	79 of 106	526	189	5	Full text, public domain (a US government work)
CIS Critical Security ControlsCenter for Internet Security, version 8.1, June 2024 9 of 153 controls with law, 267 laws	9 of 153	267	109	6	Safeguard numbers, with our own summaries, used under a CIS Controls Supporter License
ENISA NIS2 Technical Implementation GuidanceEuropean Union Agency for Cybersecurity (ENISA), version 1.0, June 2025, with mapping table version 1.2 21 of 49 controls with law, 268 laws	21 of 49	268	109	none	Section titles and the first point of each, CC BY 4.0

Drafts and candidates

14 frameworks we watch and have not read against the law yet: drafts their publishers have released for comment or announced, and final frameworks we plan to read next. Watch mode: framework drafts and candidates

Already read against the law, while still drafts: NIST AI 200-2 Draft, MIT mitigations Draft.

Laws that name a framework

18 laws These laws name a framework in their own text. What following it does differs from law to law, and each law's page says on what terms.

Jurisdiction	Law	What naming it does	Frameworks it names
A defense, or a limit on damages
Connecticut	Adoption of cybersecurity controls by businesses, exemption from punitive damages	a limit on damages	NIST CSFNIST SP 800-171NIST SP 800-53FedRAMPCIS ControlsISO/IEC 27000 seriesPCI DSS
Iowa	Tort Liability for Cybersecurity Programs, affirmative defense for a reasonable security program	a defense to a claim	NIST CSFNIST SP 800-171NIST SP 800-53FedRAMPCIS ControlsISO/IEC 27000 seriesPCI DSS
Ohio	Ohio Data Protection Act, cybersecurity program safe harbor	a defense to a claim	NIST CSFNIST SP 800-171NIST SP 800-53FedRAMPCIS ControlsISO/IEC 27000 seriesPCI DSS
Tennessee	Tennessee Information Protection Act, Attorney General enforcement and NIST safe harbor	a defense to a claim	NIST Privacy FrameworkAPEC CBPR and PRP
Texas	Cybersecurity Program safe harbor from exemplary damages (S.B. 2610)	a limit on damages	NIST CSFNIST SP 800-171NIST SP 800-53FedRAMPCIS ControlsISO/IEC 27000 seriesHITRUST CSFSecure Controls FrameworkSOC 2PCI DSS or a comparable framework
Utah	Cybersecurity Affirmative Defense Act	a defense to a claim	NIST SP 800-171NIST SP 800-53FedRAMPCIS ControlsISO/IEC 27000 seriesPCI DSS
Presumed to conform
California	Security of Connected Devices	presumed to conform	NIST IoT labeling criteria
El Salvador	Resolución ANIA 0001/2025, registro obligatorio para decisiones consecuenciales	presumed to conform	ISO/IEC 42001ISO/IEC 23053ISO/IEC 23894ISO/IEC 38507NIST AI RMFIEEE 7000IEEE 7001IEEE 7010 or a comparable framework
European Union	AI Act, Article 17 (quality management system) from 2 Dec 2027, in 13 months	presumed to conform	EN 18286
Michigan	Senate Bill 360 (2025-2026), Identity Theft Protection Act reasonable security procedures duty proposed	presumed to conform	NIST CSF
Required
Michigan	Senate Bill 360 (2025-2026), Identity Theft Protection Act reasonable security procedures duty proposed	required	NIST CSF or a comparable framework
Montana	Right to Compute Act (SB 212, 2025), critical AI infrastructure risk management duty	required	NIST AI RMFISO/IEC 42001 or a comparable framework
Montenegro	Law on Information Security, Essential and Important Entities	required	ISO/IEC 27001
Nevada	Security measures for data collectors maintaining personal information	required	CIS Controlsthe corresponding NIST standards
United States	Safeguarding Covered Defense Information and Cyber Incident Reporting (DFARS 252.204-7012)	required	NIST SP 800-171FedRAMP
Named as one way to do it
Côte d'Ivoire	RGSSI and PPIC Compliance Duty	one accepted way	ISO/IEC 27001ISO/IEC 27002
European Union	AI Act, Article 53 (obligations for providers of general-purpose AI models)	one accepted way	GPAI Code of Practice
European Union	AI Act, Article 55 (obligations for providers of general-purpose AI models with systemic risk)	one accepted way	GPAI Code of Practice
Georgia	SB 351 (2024), commercial entity age verification for material harmful to minors	one accepted way	NIST identity assurance level 2

How we read a framework against the law

Three frameworks are read line by line: each requirement line of the laws in their field (the AI, scraping and news aggregation laws for the NIST AI RMF, the privacy, communications and age assurance laws for the NIST Privacy Framework, the cybersecurity laws for the NIST CSF 2.0) was mapped on its own to the control it bears on most closely. A line placed there is read against another of the three as well where its subject reaches into it (privacy lines against the NIST AI RMF; AI, scraping and cybersecurity lines against the NIST Privacy Framework; AI, privacy and age assurance lines against the NIST CSF 2.0), and counts on every control it lands on. The others are read through the kinds of duty a law carries, such as a ban, a disclosure or a security duty, counting a kind of duty only where the law's own lines, as read against the NIST AI RMF, bear it out.

Laws on accessibility, cloud, export, identity, liability and content moderation are not read against these frameworks yet. Laws that are no longer in force are left out of every count.

A framework is not law, and it is not guidance either: what the law library holds says how LexLint tells the three apart.

Sources

Each framework's text is its publisher's, at the edition below, and its page links the document we read. The laws, and our reading of them, come from the LexLint law library.

Source	Publisher	Edition	What we print, and on what terms	Read it at
NIST AI Risk Management Framework	National Institute of Standards and Technology	version 1.0, January 2023 (NIST AI 100-1)	Full text, public domain (a US government work)	nvlpubs.nist.gov
NIST Generative AI Profile	National Institute of Standards and Technology	July 2024 (NIST AI 600-1)	Full text, public domain (a US government work)	nvlpubs.nist.gov
NIST TEVV-Athlon Framework for Evaluating AI Systems	National Institute of Standards and Technology	initial public draft, August 2026 (NIST AI 200-2 ipd)	Excerpts, public domain (a US government work)	doi.org
OWASP Top 10 for LLM Applications	OWASP GenAI Security Project	2026 edition, August 2026	Excerpts, CC BY-SA 4.0	genai.owasp.org
OWASP Top 10 for Agentic Applications	OWASP GenAI Security Project	2026 edition, December 2025	Excerpts, CC BY-SA 4.0	genai.owasp.org
MIT AI Risk Mitigation Taxonomy	MIT AI Risk Initiative	preliminary taxonomy, July 2025	Full text, CC BY 4.0	airisk.mit.edu
NIST Privacy Framework	National Institute of Standards and Technology	version 1.0, January 2020	Full text, public domain (a US government work)	nvlpubs.nist.gov
NIST Cybersecurity Framework	National Institute of Standards and Technology	version 2.0, February 2024 (NIST CSWP 29)	Full text, public domain (a US government work)	nvlpubs.nist.gov
CIS Critical Security Controls	Center for Internet Security	version 8.1, June 2024	Safeguard numbers, with our own summaries, used under a CIS Controls Supporter License	cas.docs.cisecurity.org
FINOS AI Governance Framework	FINOS	version 2, as maintained on October 7, 2026	Full text, CC BY 4.0	air-governance-framework.finos.org
ENISA NIS2 Technical Implementation Guidance	European Union Agency for Cybersecurity (ENISA)	version 1.0, June 2025, with mapping table version 1.2	Section titles and the first point of each, CC BY 4.0	www.enisa.europa.eu
ETSI EN 304 223, Baseline Cyber Security Requirements for AI Models and Systems	European Telecommunications Standards Institute (ETSI)	version 2.1.1, December 2025	Provision numbers, with our own summaries, ETSI's copyright; we print numbers only	www.etsi.org
The laws we track	The legislature, regulator or court that made each one	as of 14 Nov 2026	Our reading of each law's requirement lines, and of the frameworks a law names	Each law's page links its official text

Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.

The mapping of these frameworks to laws, and the summaries we print beside some of them, are our own reading. No publisher listed here has reviewed or endorsed them.