Law / Frameworks / Crosswalk / ENISA NIS2 guidance to FINOS AIGF

The ENISA NIS2 Technical Implementation Guidance, mapped to the FINOS AI Governance Framework

20 of ENISA NIS2 guidance's requirements connect to 13 of FINOS AIGF's through 276 laws in 112 jurisdictions. Two requirements connect when the same duties, in at least 2 laws we track, reach both. The connections are our own reading of the law; no framework publisher has reviewed or endorsed them.

From: ENISA NIS2 Technical Implementation Guidance, version 1.0, June 2025, with mapping table version 1.2, European Union Agency for Cybersecurity (ENISA)
To: FINOS AI Governance Framework, version 2, as maintained on October 7, 2026, FINOS
See also: FINOS AIGF to ENISA NIS2 guidance, the other way · every pair in the crosswalk · law library as of 19 Oct 2026

Download this mapping, with every law behind each connection: finos-ai-governance-framework--enisa-nis2-guidance.csv · finos-ai-governance-framework--enisa-nis2-guidance.json

ENISA NIS2 guidance	FINOS AIGF	Laws	Jurisdictions	Where the laws stand
1.1Policy on the security of network and information systems	AIR-DET-004AI System Observability	115	62	105 in force, 6 not yet in force, 4 proposed
	The 115 laws behind 1.1 and AIR-DET-004 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium and 105 more, every one in the free file.
	AIR-DET-021Agent Decision Audit and Explainability	115	62	105 in force, 6 not yet in force, 4 proposed
	The 115 laws behind 1.1 and AIR-DET-021 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium and 105 more, every one in the free file.
	AIR-PREV-005System Acceptance Testing	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind 1.1 and AIR-PREV-005 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	AIR-PREV-006Data Quality & Classification/Sensitivity	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind 1.1 and AIR-PREV-006 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind 1.1 and AIR-PREV-024 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	AIR-DET-011Human Feedback Loop for AI Systems	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind 1.1 and AIR-DET-011 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	5	5	4 in force, 1 not yet in force
	The 5 laws behind 1.1 and AIR-PREV-007 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems	5	5	4 in force, 1 not yet in force
	The 5 laws behind 1.1 and AIR-PREV-008 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-012Role-Based Access Control for AI Data	5	5	4 in force, 1 not yet in force
	The 5 laws behind 1.1 and AIR-PREV-012 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-014Encryption of AI Data at Rest	5	5	4 in force, 1 not yet in force
	The 5 laws behind 1.1 and AIR-PREV-014 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-017AI Firewall Implementation and Management	5	5	4 in force, 1 not yet in force
	The 5 laws behind 1.1 and AIR-PREV-017 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-020MCP Server Security Governance	5	5	4 in force, 1 not yet in force
	The 5 laws behind 1.1 and AIR-PREV-020 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-DET-001AI Data Leakage Prevention and Detection	5	5	4 in force, 1 not yet in force
	The 5 laws behind 1.1 and AIR-DET-001 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
1.2Roles, responsibilities and authorities	AIR-PREV-005System Acceptance Testing	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind 1.2 and AIR-PREV-005 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	AIR-PREV-006Data Quality & Classification/Sensitivity	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind 1.2 and AIR-PREV-006 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind 1.2 and AIR-PREV-024 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	AIR-DET-004AI System Observability	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind 1.2 and AIR-DET-004 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	AIR-DET-011Human Feedback Loop for AI Systems	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind 1.2 and AIR-DET-011 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	AIR-DET-021Agent Decision Audit and Explainability	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind 1.2 and AIR-DET-021 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	5	5	4 in force, 1 not yet in force
	The 5 laws behind 1.2 and AIR-PREV-007 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems	5	5	4 in force, 1 not yet in force
	The 5 laws behind 1.2 and AIR-PREV-008 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-012Role-Based Access Control for AI Data	5	5	4 in force, 1 not yet in force
	The 5 laws behind 1.2 and AIR-PREV-012 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-014Encryption of AI Data at Rest	5	5	4 in force, 1 not yet in force
	The 5 laws behind 1.2 and AIR-PREV-014 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-017AI Firewall Implementation and Management	5	5	4 in force, 1 not yet in force
	The 5 laws behind 1.2 and AIR-PREV-017 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-020MCP Server Security Governance	5	5	4 in force, 1 not yet in force
	The 5 laws behind 1.2 and AIR-PREV-020 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-DET-001AI Data Leakage Prevention and Detection	5	5	4 in force, 1 not yet in force
	The 5 laws behind 1.2 and AIR-DET-001 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
2.1Risk management framework	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 2.1 and AIR-PREV-007 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 2.1 and AIR-PREV-008 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-012Role-Based Access Control for AI Data	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 2.1 and AIR-PREV-012 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-014Encryption of AI Data at Rest	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 2.1 and AIR-PREV-014 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-017AI Firewall Implementation and Management	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 2.1 and AIR-PREV-017 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-020MCP Server Security Governance	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 2.1 and AIR-PREV-020 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-DET-001AI Data Leakage Prevention and Detection	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 2.1 and AIR-DET-001 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-DET-004AI System Observability	11	9	9 in force, 2 not yet in force
	The 11 laws behind 2.1 and AIR-DET-004 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam and 1 more, every one in the free file.
	AIR-DET-021Agent Decision Audit and Explainability	11	9	9 in force, 2 not yet in force
	The 11 laws behind 2.1 and AIR-DET-021 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam and 1 more, every one in the free file.
	AIR-PREV-005System Acceptance Testing	9	9	8 in force, 1 not yet in force
	The 9 laws behind 2.1 and AIR-PREV-005 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Commission Implementing Regulation (EU) 2025/2392, Technical Description of Important and Critical Products with Digital Elements, European Union Laki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä, Essential Requirements and Certification of Health and Social Care Information Systems, Finland Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Law on Information Security, Essential and Important Entities, Montenegro DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-006Data Quality & Classification/Sensitivity	6	6	5 in force, 1 not yet in force
	The 6 laws behind 2.1 and AIR-PREV-006 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	6	6	5 in force, 1 not yet in force
	The 6 laws behind 2.1 and AIR-PREV-024 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-DET-011Human Feedback Loop for AI Systems	6	6	5 in force, 1 not yet in force
	The 6 laws behind 2.1 and AIR-DET-011 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
2.2Compliance monitoring	AIR-PREV-005System Acceptance Testing	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind 2.2 and AIR-PREV-005 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	AIR-PREV-006Data Quality & Classification/Sensitivity	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind 2.2 and AIR-PREV-006 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind 2.2 and AIR-PREV-024 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	AIR-DET-004AI System Observability	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind 2.2 and AIR-DET-004 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	AIR-DET-011Human Feedback Loop for AI Systems	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind 2.2 and AIR-DET-011 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	AIR-DET-021Agent Decision Audit and Explainability	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind 2.2 and AIR-DET-021 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	5	5	4 in force, 1 not yet in force
	The 5 laws behind 2.2 and AIR-PREV-007 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems	5	5	4 in force, 1 not yet in force
	The 5 laws behind 2.2 and AIR-PREV-008 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-012Role-Based Access Control for AI Data	5	5	4 in force, 1 not yet in force
	The 5 laws behind 2.2 and AIR-PREV-012 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-014Encryption of AI Data at Rest	5	5	4 in force, 1 not yet in force
	The 5 laws behind 2.2 and AIR-PREV-014 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-017AI Firewall Implementation and Management	5	5	4 in force, 1 not yet in force
	The 5 laws behind 2.2 and AIR-PREV-017 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-020MCP Server Security Governance	5	5	4 in force, 1 not yet in force
	The 5 laws behind 2.2 and AIR-PREV-020 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-DET-001AI Data Leakage Prevention and Detection	5	5	4 in force, 1 not yet in force
	The 5 laws behind 2.2 and AIR-DET-001 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
2.3Independent review of information and network security	AIR-PREV-005System Acceptance Testing	4	4	4 in force
2.3Independent review of information and network security	The 4 laws behind 2.3 and AIR-PREV-005 Commission Implementing Regulation (EU) 2025/2392, Technical Description of Important and Critical Products with Digital Elements, European Union Laki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä, Essential Requirements and Certification of Health and Social Care Information Systems, Finland Law on Information Security, Essential and Important Entities, Montenegro DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation, New York
3.1Incident handling policy	AIR-DET-004AI System Observability	110	69	99 in force, 6 not yet in force, 5 proposed
	The 110 laws behind 3.1 and AIR-DET-004 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident, Bangladesh Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS), Bulgaria OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law: Mandatory Security Audit Regime, Central African Republic Cybersecurity Law, Network Product and Service Security Duties, China and 100 more, every one in the free file.
	AIR-DET-021Agent Decision Audit and Explainability	109	68	98 in force, 6 not yet in force, 5 proposed
	The 109 laws behind 3.1 and AIR-DET-021 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident, Bangladesh Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS), Bulgaria OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law: Mandatory Security Audit Regime, Central African Republic Cybersecurity Law, Network Product and Service Security Duties, China and 99 more, every one in the free file.
	AIR-DET-001AI Data Leakage Prevention and Detection	108	71	101 in force, 6 not yet in force, 1 proposed
	The 108 laws behind 3.1 and AIR-DET-001 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 98 more, every one in the free file.
	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 3.1 and AIR-PREV-007 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 3.1 and AIR-PREV-008 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-012Role-Based Access Control for AI Data	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 3.1 and AIR-PREV-012 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-014Encryption of AI Data at Rest	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 3.1 and AIR-PREV-014 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-017AI Firewall Implementation and Management	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 3.1 and AIR-PREV-017 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-020MCP Server Security Governance	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 3.1 and AIR-PREV-020 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-005System Acceptance Testing	17	17	15 in force, 2 not yet in force
	The 17 laws behind 3.1 and AIR-PREV-005 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands and 7 more, every one in the free file.
	AIR-PREV-006Data Quality & Classification/Sensitivity	17	17	15 in force, 2 not yet in force
	The 17 laws behind 3.1 and AIR-PREV-006 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands and 7 more, every one in the free file.
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	17	17	15 in force, 2 not yet in force
	The 17 laws behind 3.1 and AIR-PREV-024 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands and 7 more, every one in the free file.
	AIR-DET-011Human Feedback Loop for AI Systems	17	17	15 in force, 2 not yet in force
	The 17 laws behind 3.1 and AIR-DET-011 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands and 7 more, every one in the free file.
3.2Monitoring and logging	AIR-DET-004AI System Observability	115	62	105 in force, 6 not yet in force, 4 proposed
	The 115 laws behind 3.2 and AIR-DET-004 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium and 105 more, every one in the free file.
	AIR-DET-021Agent Decision Audit and Explainability	115	62	105 in force, 6 not yet in force, 4 proposed
	The 115 laws behind 3.2 and AIR-DET-021 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium and 105 more, every one in the free file.
	AIR-PREV-005System Acceptance Testing	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind 3.2 and AIR-PREV-005 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	AIR-PREV-006Data Quality & Classification/Sensitivity	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind 3.2 and AIR-PREV-006 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind 3.2 and AIR-PREV-024 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	AIR-DET-011Human Feedback Loop for AI Systems	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind 3.2 and AIR-DET-011 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	5	5	4 in force, 1 not yet in force
	The 5 laws behind 3.2 and AIR-PREV-007 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems	5	5	4 in force, 1 not yet in force
	The 5 laws behind 3.2 and AIR-PREV-008 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-012Role-Based Access Control for AI Data	5	5	4 in force, 1 not yet in force
	The 5 laws behind 3.2 and AIR-PREV-012 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-014Encryption of AI Data at Rest	5	5	4 in force, 1 not yet in force
	The 5 laws behind 3.2 and AIR-PREV-014 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-017AI Firewall Implementation and Management	5	5	4 in force, 1 not yet in force
	The 5 laws behind 3.2 and AIR-PREV-017 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-020MCP Server Security Governance	5	5	4 in force, 1 not yet in force
	The 5 laws behind 3.2 and AIR-PREV-020 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-DET-001AI Data Leakage Prevention and Detection	5	5	4 in force, 1 not yet in force
	The 5 laws behind 3.2 and AIR-DET-001 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
3.4Event assessment and classification	AIR-DET-004AI System Observability	108	69	98 in force, 5 not yet in force, 5 proposed
	The 108 laws behind 3.4 and AIR-DET-004 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident, Bangladesh Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS), Bulgaria OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law: Mandatory Security Audit Regime, Central African Republic Cybersecurity Law, Network Product and Service Security Duties, China and 98 more, every one in the free file.
	AIR-DET-021Agent Decision Audit and Explainability	107	68	97 in force, 5 not yet in force, 5 proposed
	The 107 laws behind 3.4 and AIR-DET-021 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident, Bangladesh Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS), Bulgaria OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law: Mandatory Security Audit Regime, Central African Republic Cybersecurity Law, Network Product and Service Security Duties, China and 97 more, every one in the free file.
	AIR-PREV-005System Acceptance Testing	15	15	14 in force, 1 not yet in force
	The 15 laws behind 3.4 and AIR-PREV-005 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	AIR-PREV-006Data Quality & Classification/Sensitivity	15	15	14 in force, 1 not yet in force
	The 15 laws behind 3.4 and AIR-PREV-006 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	15	15	14 in force, 1 not yet in force
	The 15 laws behind 3.4 and AIR-PREV-024 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	AIR-DET-011Human Feedback Loop for AI Systems	15	15	14 in force, 1 not yet in force
	The 15 laws behind 3.4 and AIR-DET-011 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	AIR-DET-001AI Data Leakage Prevention and Detection	9	8	8 in force, 1 not yet in force
	The 9 laws behind 3.4 and AIR-DET-001 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Information and Communications Act, 2009, security of information and communications services (subscriber risk notification), Gambia Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	8	7	7 in force, 1 not yet in force
	The 8 laws behind 3.4 and AIR-PREV-007 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems	8	7	7 in force, 1 not yet in force
	The 8 laws behind 3.4 and AIR-PREV-008 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	AIR-PREV-012Role-Based Access Control for AI Data	8	7	7 in force, 1 not yet in force
	The 8 laws behind 3.4 and AIR-PREV-012 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	AIR-PREV-014Encryption of AI Data at Rest	8	7	7 in force, 1 not yet in force
	The 8 laws behind 3.4 and AIR-PREV-014 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	AIR-PREV-017AI Firewall Implementation and Management	8	7	7 in force, 1 not yet in force
	The 8 laws behind 3.4 and AIR-PREV-017 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	AIR-PREV-020MCP Server Security Governance	8	7	7 in force, 1 not yet in force
	The 8 laws behind 3.4 and AIR-PREV-020 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
3.5Incident response	AIR-DET-021Agent Decision Audit and Explainability	113	72	103 in force, 5 not yet in force, 5 proposed
	The 113 laws behind 3.5 and AIR-DET-021 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident, Bangladesh Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS), Bulgaria Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC), Cameroon and 103 more, every one in the free file.
	AIR-DET-004AI System Observability	108	69	98 in force, 5 not yet in force, 5 proposed
	The 108 laws behind 3.5 and AIR-DET-004 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident, Bangladesh Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS), Bulgaria OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law: Mandatory Security Audit Regime, Central African Republic Cybersecurity Law, Network Product and Service Security Duties, China and 98 more, every one in the free file.
	AIR-PREV-005System Acceptance Testing	15	15	14 in force, 1 not yet in force
	The 15 laws behind 3.5 and AIR-PREV-005 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	AIR-PREV-006Data Quality & Classification/Sensitivity	15	15	14 in force, 1 not yet in force
	The 15 laws behind 3.5 and AIR-PREV-006 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	15	15	14 in force, 1 not yet in force
	The 15 laws behind 3.5 and AIR-PREV-024 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	AIR-DET-011Human Feedback Loop for AI Systems	15	15	14 in force, 1 not yet in force
	The 15 laws behind 3.5 and AIR-DET-011 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	AIR-DET-001AI Data Leakage Prevention and Detection	9	8	8 in force, 1 not yet in force
	The 9 laws behind 3.5 and AIR-DET-001 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Information and Communications Act, 2009, security of information and communications services (subscriber risk notification), Gambia Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	8	7	7 in force, 1 not yet in force
	The 8 laws behind 3.5 and AIR-PREV-007 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems	8	7	7 in force, 1 not yet in force
	The 8 laws behind 3.5 and AIR-PREV-008 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	AIR-PREV-012Role-Based Access Control for AI Data	8	7	7 in force, 1 not yet in force
	The 8 laws behind 3.5 and AIR-PREV-012 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	AIR-PREV-014Encryption of AI Data at Rest	8	7	7 in force, 1 not yet in force
	The 8 laws behind 3.5 and AIR-PREV-014 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	AIR-PREV-017AI Firewall Implementation and Management	8	7	7 in force, 1 not yet in force
	The 8 laws behind 3.5 and AIR-PREV-017 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	AIR-PREV-020MCP Server Security Governance	8	7	7 in force, 1 not yet in force
	The 8 laws behind 3.5 and AIR-PREV-020 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
3.6Post-incident reviews	AIR-DET-004AI System Observability	107	68	97 in force, 5 not yet in force, 5 proposed
	The 107 laws behind 3.6 and AIR-DET-004 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident, Bangladesh Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS), Bulgaria OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law: Mandatory Security Audit Regime, Central African Republic Cybersecurity Law, Network Product and Service Security Duties, China and 97 more, every one in the free file.
	AIR-DET-021Agent Decision Audit and Explainability	107	68	97 in force, 5 not yet in force, 5 proposed
	The 107 laws behind 3.6 and AIR-DET-021 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident, Bangladesh Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS), Bulgaria OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law: Mandatory Security Audit Regime, Central African Republic Cybersecurity Law, Network Product and Service Security Duties, China and 97 more, every one in the free file.
	AIR-PREV-005System Acceptance Testing	15	15	14 in force, 1 not yet in force
	The 15 laws behind 3.6 and AIR-PREV-005 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	AIR-PREV-006Data Quality & Classification/Sensitivity	15	15	14 in force, 1 not yet in force
	The 15 laws behind 3.6 and AIR-PREV-006 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	15	15	14 in force, 1 not yet in force
	The 15 laws behind 3.6 and AIR-PREV-024 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	AIR-DET-011Human Feedback Loop for AI Systems	15	15	14 in force, 1 not yet in force
	The 15 laws behind 3.6 and AIR-DET-011 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	8	7	7 in force, 1 not yet in force
	The 8 laws behind 3.6 and AIR-PREV-007 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems	8	7	7 in force, 1 not yet in force
	The 8 laws behind 3.6 and AIR-PREV-008 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	AIR-PREV-012Role-Based Access Control for AI Data	8	7	7 in force, 1 not yet in force
	The 8 laws behind 3.6 and AIR-PREV-012 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	AIR-PREV-014Encryption of AI Data at Rest	8	7	7 in force, 1 not yet in force
	The 8 laws behind 3.6 and AIR-PREV-014 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	AIR-PREV-017AI Firewall Implementation and Management	8	7	7 in force, 1 not yet in force
	The 8 laws behind 3.6 and AIR-PREV-017 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	AIR-PREV-020MCP Server Security Governance	8	7	7 in force, 1 not yet in force
	The 8 laws behind 3.6 and AIR-PREV-020 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	AIR-DET-001AI Data Leakage Prevention and Detection	8	7	7 in force, 1 not yet in force
	The 8 laws behind 3.6 and AIR-DET-001 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
4.1Business continuity and disaster recovery plan	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 4.1 and AIR-PREV-007 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 4.1 and AIR-PREV-008 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-012Role-Based Access Control for AI Data	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 4.1 and AIR-PREV-012 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-014Encryption of AI Data at Rest	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 4.1 and AIR-PREV-014 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-017AI Firewall Implementation and Management	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 4.1 and AIR-PREV-017 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-020MCP Server Security Governance	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 4.1 and AIR-PREV-020 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-DET-001AI Data Leakage Prevention and Detection	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 4.1 and AIR-DET-001 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-DET-004AI System Observability	10	8	8 in force, 2 not yet in force
	The 10 laws behind 4.1 and AIR-DET-004 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-DET-021Agent Decision Audit and Explainability	10	8	8 in force, 2 not yet in force
	The 10 laws behind 4.1 and AIR-DET-021 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-005System Acceptance Testing	5	5	4 in force, 1 not yet in force
	The 5 laws behind 4.1 and AIR-PREV-005 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-006Data Quality & Classification/Sensitivity	5	5	4 in force, 1 not yet in force
	The 5 laws behind 4.1 and AIR-PREV-006 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	5	5	4 in force, 1 not yet in force
	The 5 laws behind 4.1 and AIR-PREV-024 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-DET-011Human Feedback Loop for AI Systems	5	5	4 in force, 1 not yet in force
	The 5 laws behind 4.1 and AIR-DET-011 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
4.2Backup and redundancy management	AIR-DET-004AI System Observability	11	11	11 in force
	The 11 laws behind 4.2 and AIR-DET-004 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Florida Information Protection Act, data security and disposal duty, Florida Destruction of Personal Information Records, Hawaii Kansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information, Kansas Data Classification Policy, Kuwait Identity Theft Protection Act, destruction of data no longer needed, Michigan Impediment of Identity Theft, record destruction duty, Montana Loi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Security Duties, Morocco Identity Theft Protection Act, destruction of personal information records, North Carolina Sarbanes-Oxley Act section 802: retention of audit and review workpapers and records by an accountant who audits an issuer, United States and 1 more, every one in the free file.
	AIR-DET-021Agent Decision Audit and Explainability	11	11	11 in force
	The 11 laws behind 4.2 and AIR-DET-021 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Florida Information Protection Act, data security and disposal duty, Florida Destruction of Personal Information Records, Hawaii Kansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information, Kansas Data Classification Policy, Kuwait Identity Theft Protection Act, destruction of data no longer needed, Michigan Impediment of Identity Theft, record destruction duty, Montana Loi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Security Duties, Morocco Identity Theft Protection Act, destruction of personal information records, North Carolina Sarbanes-Oxley Act section 802: retention of audit and review workpapers and records by an accountant who audits an issuer, United States and 1 more, every one in the free file.
4.3Crisis management	AIR-DET-004AI System Observability	107	68	97 in force, 5 not yet in force, 5 proposed
	The 107 laws behind 4.3 and AIR-DET-004 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident, Bangladesh Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS), Bulgaria OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law: Mandatory Security Audit Regime, Central African Republic Cybersecurity Law, Network Product and Service Security Duties, China and 97 more, every one in the free file.
	AIR-DET-021Agent Decision Audit and Explainability	107	68	97 in force, 5 not yet in force, 5 proposed
	The 107 laws behind 4.3 and AIR-DET-021 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Incident Handling and Notification Obligation, Andorra Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations, Austria Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident, Bangladesh Loi du 26 avril 2024, Significant-Incident Notification Obligations, Belgium Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS), Bulgaria OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law: Mandatory Security Audit Regime, Central African Republic Cybersecurity Law, Network Product and Service Security Duties, China and 97 more, every one in the free file.
	AIR-PREV-005System Acceptance Testing	15	15	14 in force, 1 not yet in force
	The 15 laws behind 4.3 and AIR-PREV-005 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	AIR-PREV-006Data Quality & Classification/Sensitivity	15	15	14 in force, 1 not yet in force
	The 15 laws behind 4.3 and AIR-PREV-006 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	15	15	14 in force, 1 not yet in force
	The 15 laws behind 4.3 and AIR-PREV-024 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	AIR-DET-011Human Feedback Loop for AI Systems	15	15	14 in force, 1 not yet in force
	The 15 laws behind 4.3 and AIR-DET-011 Law No. 25/2024, On Cybersecurity, Albania OSFI Guideline B-10, Third-Party Risk Management, Canada Cybersecurity Law, Network Product and Service Security Duties, China DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers), European Union Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars, Finland Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification, Italy Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Malta DORA Regulations (S.L. 330.20), Malta Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details, Netherlands Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions, Poland and 5 more, every one in the free file.
	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	8	7	7 in force, 1 not yet in force
	The 8 laws behind 4.3 and AIR-PREV-007 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems	8	7	7 in force, 1 not yet in force
	The 8 laws behind 4.3 and AIR-PREV-008 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	AIR-PREV-012Role-Based Access Control for AI Data	8	7	7 in force, 1 not yet in force
	The 8 laws behind 4.3 and AIR-PREV-012 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	AIR-PREV-014Encryption of AI Data at Rest	8	7	7 in force, 1 not yet in force
	The 8 laws behind 4.3 and AIR-PREV-014 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	AIR-PREV-017AI Firewall Implementation and Management	8	7	7 in force, 1 not yet in force
	The 8 laws behind 4.3 and AIR-PREV-017 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	AIR-PREV-020MCP Server Security Governance	8	7	7 in force, 1 not yet in force
	The 8 laws behind 4.3 and AIR-PREV-020 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
	AIR-DET-001AI Data Leakage Prevention and Detection	8	7	7 in force, 1 not yet in force
	The 8 laws behind 4.3 and AIR-DET-001 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam
6.2Secure development life cycle	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 6.2 and AIR-PREV-007 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 6.2 and AIR-PREV-008 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-012Role-Based Access Control for AI Data	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 6.2 and AIR-PREV-012 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-014Encryption of AI Data at Rest	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 6.2 and AIR-PREV-014 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-017AI Firewall Implementation and Management	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 6.2 and AIR-PREV-017 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-020MCP Server Security Governance	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 6.2 and AIR-PREV-020 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-DET-001AI Data Leakage Prevention and Detection	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 6.2 and AIR-DET-001 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-DET-004AI System Observability	10	8	8 in force, 2 not yet in force
	The 10 laws behind 6.2 and AIR-DET-004 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-DET-021Agent Decision Audit and Explainability	10	8	8 in force, 2 not yet in force
	The 10 laws behind 6.2 and AIR-DET-021 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-005System Acceptance Testing	5	5	4 in force, 1 not yet in force
	The 5 laws behind 6.2 and AIR-PREV-005 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-006Data Quality & Classification/Sensitivity	5	5	4 in force, 1 not yet in force
	The 5 laws behind 6.2 and AIR-PREV-006 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	5	5	4 in force, 1 not yet in force
	The 5 laws behind 6.2 and AIR-PREV-024 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-DET-011Human Feedback Loop for AI Systems	5	5	4 in force, 1 not yet in force
	The 5 laws behind 6.2 and AIR-DET-011 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
6.5Security testing	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 6.5 and AIR-PREV-007 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 6.5 and AIR-PREV-008 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-012Role-Based Access Control for AI Data	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 6.5 and AIR-PREV-012 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-014Encryption of AI Data at Rest	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 6.5 and AIR-PREV-014 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-017AI Firewall Implementation and Management	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 6.5 and AIR-PREV-017 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-020MCP Server Security Governance	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 6.5 and AIR-PREV-020 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-DET-001AI Data Leakage Prevention and Detection	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 6.5 and AIR-DET-001 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-DET-004AI System Observability	10	8	8 in force, 2 not yet in force
	The 10 laws behind 6.5 and AIR-DET-004 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-DET-021Agent Decision Audit and Explainability	10	8	8 in force, 2 not yet in force
	The 10 laws behind 6.5 and AIR-DET-021 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-005System Acceptance Testing	5	5	4 in force, 1 not yet in force
	The 5 laws behind 6.5 and AIR-PREV-005 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-006Data Quality & Classification/Sensitivity	5	5	4 in force, 1 not yet in force
	The 5 laws behind 6.5 and AIR-PREV-006 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	5	5	4 in force, 1 not yet in force
	The 5 laws behind 6.5 and AIR-PREV-024 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-DET-011Human Feedback Loop for AI Systems	5	5	4 in force, 1 not yet in force
	The 5 laws behind 6.5 and AIR-DET-011 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
6.10Vulnerability handling and disclosure	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 6.10 and AIR-PREV-007 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 6.10 and AIR-PREV-008 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-012Role-Based Access Control for AI Data	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 6.10 and AIR-PREV-012 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-014Encryption of AI Data at Rest	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 6.10 and AIR-PREV-014 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-017AI Firewall Implementation and Management	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 6.10 and AIR-PREV-017 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-020MCP Server Security Governance	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 6.10 and AIR-PREV-020 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-DET-001AI Data Leakage Prevention and Detection	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 6.10 and AIR-DET-001 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-DET-021Agent Decision Audit and Explainability	19	17	17 in force, 2 not yet in force
	The 19 laws behind 6.10 and AIR-DET-021 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC), Cameroon Cybersecurity Law: Network and Information System Security Duty, Central African Republic Cybersecurity Law, Network Product and Service Security Duties, China Digital Code, Livre IV: ICT Product and Service Vendor Security Certification, Democratic Republic of the Congo Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Laki sähköisen viestinnän palveluista, Security Incident Notices by Telecommunications Operators, Finland Sécurité des systèmes d'information (dispositions communes), Gabon and 9 more, every one in the free file.
	AIR-DET-004AI System Observability	13	11	11 in force, 2 not yet in force
	The 13 laws behind 6.10 and AIR-DET-004 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Laki sähköisen viestinnän palveluista, Security Incident Notices by Telecommunications Operators, Finland Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Loi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Incident and Vulnerability Notification Duties, Morocco Cybersecurity Law, Incident Notification and Responsible Vulnerability Disclosure, Mozambique Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set and 3 more, every one in the free file.
	AIR-PREV-005System Acceptance Testing	5	5	4 in force, 1 not yet in force
	The 5 laws behind 6.10 and AIR-PREV-005 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-006Data Quality & Classification/Sensitivity	5	5	4 in force, 1 not yet in force
	The 5 laws behind 6.10 and AIR-PREV-006 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	5	5	4 in force, 1 not yet in force
	The 5 laws behind 6.10 and AIR-PREV-024 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-DET-011Human Feedback Loop for AI Systems	5	5	4 in force, 1 not yet in force
	The 5 laws behind 6.10 and AIR-DET-011 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
9.1Cryptography	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 9.1 and AIR-PREV-007 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 9.1 and AIR-PREV-008 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-012Role-Based Access Control for AI Data	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 9.1 and AIR-PREV-012 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-014Encryption of AI Data at Rest	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 9.1 and AIR-PREV-014 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-017AI Firewall Implementation and Management	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 9.1 and AIR-PREV-017 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-020MCP Server Security Governance	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 9.1 and AIR-PREV-020 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-DET-001AI Data Leakage Prevention and Detection	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 9.1 and AIR-DET-001 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-DET-004AI System Observability	10	8	8 in force, 2 not yet in force
	The 10 laws behind 9.1 and AIR-DET-004 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-DET-021Agent Decision Audit and Explainability	10	8	8 in force, 2 not yet in force
	The 10 laws behind 9.1 and AIR-DET-021 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-005System Acceptance Testing	5	5	4 in force, 1 not yet in force
	The 5 laws behind 9.1 and AIR-PREV-005 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-006Data Quality & Classification/Sensitivity	5	5	4 in force, 1 not yet in force
	The 5 laws behind 9.1 and AIR-PREV-006 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	5	5	4 in force, 1 not yet in force
	The 5 laws behind 9.1 and AIR-PREV-024 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-DET-011Human Feedback Loop for AI Systems	5	5	4 in force, 1 not yet in force
	The 5 laws behind 9.1 and AIR-DET-011 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
11.2Management of access rights	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 11.2 and AIR-PREV-007 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 11.2 and AIR-PREV-008 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-012Role-Based Access Control for AI Data	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 11.2 and AIR-PREV-012 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-014Encryption of AI Data at Rest	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 11.2 and AIR-PREV-014 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-017AI Firewall Implementation and Management	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 11.2 and AIR-PREV-017 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-PREV-020MCP Server Security Governance	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 11.2 and AIR-PREV-020 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-DET-001AI Data Leakage Prevention and Detection	107	70	100 in force, 6 not yet in force, 1 proposed
	The 107 laws behind 11.2 and AIR-DET-001 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases, Angola Arkansas Personal Information Protection Act, reasonable security procedures, Arkansas Security Standards for Smart Devices, Australia Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40), Belarus Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits, Benin Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment), Brazil Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Burundi and 97 more, every one in the free file.
	AIR-DET-004AI System Observability	10	8	8 in force, 2 not yet in force
	The 10 laws behind 11.2 and AIR-DET-004 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-DET-021Agent Decision Audit and Explainability	10	8	8 in force, 2 not yet in force
	The 10 laws behind 11.2 and AIR-DET-021 Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties, Angola Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cyber Security Management Act, Cyber Security Incident Reporting, Taiwan Cybersecurity Act 2025, Critical Infrastructure Operator Obligations, Tonga from a date not yet set Cybersecurity Incident Reporting and Emergency Response, Tunisia Cybersecurity Law, Incident Response and Reporting Duties, Vietnam Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-005System Acceptance Testing	5	5	4 in force, 1 not yet in force
	The 5 laws behind 11.2 and AIR-PREV-005 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-006Data Quality & Classification/Sensitivity	5	5	4 in force, 1 not yet in force
	The 5 laws behind 11.2 and AIR-PREV-006 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	5	5	4 in force, 1 not yet in force
	The 5 laws behind 11.2 and AIR-PREV-024 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-DET-011Human Feedback Loop for AI Systems	5	5	4 in force, 1 not yet in force
	The 5 laws behind 11.2 and AIR-DET-011 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
12.2Handling of assets	AIR-DET-004AI System Observability	11	11	11 in force
	The 11 laws behind 12.2 and AIR-DET-004 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Florida Information Protection Act, data security and disposal duty, Florida Destruction of Personal Information Records, Hawaii Kansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information, Kansas Data Classification Policy, Kuwait Identity Theft Protection Act, destruction of data no longer needed, Michigan Impediment of Identity Theft, record destruction duty, Montana Loi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Security Duties, Morocco Identity Theft Protection Act, destruction of personal information records, North Carolina Sarbanes-Oxley Act section 802: retention of audit and review workpapers and records by an accountant who audits an issuer, United States and 1 more, every one in the free file.
	AIR-DET-021Agent Decision Audit and Explainability	11	11	11 in force
	The 11 laws behind 12.2 and AIR-DET-021 Data Breach Notification Act, reasonable security measures and disposal of records, Alabama Florida Information Protection Act, data security and disposal duty, Florida Destruction of Personal Information Records, Hawaii Kansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information, Kansas Data Classification Policy, Kuwait Identity Theft Protection Act, destruction of data no longer needed, Michigan Impediment of Identity Theft, record destruction duty, Montana Loi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Security Duties, Morocco Identity Theft Protection Act, destruction of personal information records, North Carolina Sarbanes-Oxley Act section 802: retention of audit and review workpapers and records by an accountant who audits an issuer, United States and 1 more, every one in the free file.
12.4Asset inventory	AIR-PREV-005System Acceptance Testing	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind 12.4 and AIR-PREV-005 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	AIR-PREV-006Data Quality & Classification/Sensitivity	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind 12.4 and AIR-PREV-006 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind 12.4 and AIR-PREV-024 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	AIR-DET-004AI System Observability	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind 12.4 and AIR-DET-004 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	AIR-DET-011Human Feedback Loop for AI Systems	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind 12.4 and AIR-DET-011 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	AIR-DET-021Agent Decision Audit and Explainability	105	52	95 in force, 6 not yet in force, 4 proposed
	The 105 laws behind 12.4 and AIR-DET-021 Law No. 25/2024, On Cybersecurity, Albania Llei 22/2022, Cybersecurity Risk-Management Obligations, Andorra Security Standards for Smart Devices, Australia Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification, Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties, Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria, Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures, Austria Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure, Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance, Belgium Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS), Bulgaria and 95 more, every one in the free file.
	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	5	5	4 in force, 1 not yet in force
	The 5 laws behind 12.4 and AIR-PREV-007 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems	5	5	4 in force, 1 not yet in force
	The 5 laws behind 12.4 and AIR-PREV-008 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-012Role-Based Access Control for AI Data	5	5	4 in force, 1 not yet in force
	The 5 laws behind 12.4 and AIR-PREV-012 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-014Encryption of AI Data at Rest	5	5	4 in force, 1 not yet in force
	The 5 laws behind 12.4 and AIR-PREV-014 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-017AI Firewall Implementation and Management	5	5	4 in force, 1 not yet in force
	The 5 laws behind 12.4 and AIR-PREV-017 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-PREV-020MCP Server Security Governance	5	5	4 in force, 1 not yet in force
	The 5 laws behind 12.4 and AIR-PREV-020 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam
	AIR-DET-001AI Data Leakage Prevention and Detection	5	5	4 in force, 1 not yet in force
	The 5 laws behind 12.4 and AIR-DET-001 Cybersecurity Law, Network Product and Service Security Duties, China Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations, Ethiopia from 21 Jul 2027, in 9 months Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements, Latvia Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit, Taiwan Cybersecurity Law, Information System Classification and Protection Measures, Vietnam

Not connected to the FINOS AIGF: 29 of ENISA NIS2 guidance's requirements

Short of 2 laws

The same duties reach these and a FINOS AIGF control, in fewer than 2 of the laws we track.

5.1 Supply chain security policy: with AIR-DET-001 and AIR-DET-004 through Information and Communications Act, 2009, security of information and communications services (subscriber risk notification), Gambia

No law we track reaches these

No duty in the laws we track reaches these requirements.

3.3 Event reporting
5.2 Directory of suppliers and service providers
6.1 Security in acquisition of ICT services or ICT products
6.3 Configuration management
6.4 Change management, repairs and maintenance
6.6 Security patch management
6.7 Network security
6.8 Network segmentation
6.9 Protection against malicious and unauthorised software
7.1 Policies and procedures to assess the effectiveness of cybersecurity risk-management measures
8.1 Awareness raising and basic cyber hygiene practices
8.2 Security training
10.1 Human resources security
10.2 Verification of background
10.3 Termination or change of employment procedures
10.4 Disciplinary process
11.1 Access control policy
11.3 Privileged accounts and system administration accounts
11.4 Administration systems
11.5 Identification
11.6 Authentication
11.7 Multi-factor authentication
12.1 Asset classification
12.3 Removable media policy
12.5 Deposit, return or deletion of assets upon termination of employment
13.1 Supporting utilities
13.2 Protection against physical and environmental threats
13.3 Perimeter and physical access control

How these connections are drawn

Each requirement line in the laws we track is read against the framework for its subject (the AI, scraping and news aggregation laws against the NIST AI RMF, the privacy, communications and age assurance laws against the NIST Privacy Framework, the cybersecurity laws against the NIST CSF 2.0); laws on liability and content moderation are not read against any framework yet. A line reaches either framework through a kind of duty its law carries, and only where that kind of duty also reaches, on that same line, the NIST framework for the line's own subject. Two requirements connect when lines in at least 2 laws reach both. That says the same duties reach both; it does not say the two are alike, or that running either one does what a law asks.

Every duty line in the cybersecurity laws we track has been read against the framework for its subject.

Sources and licenses

ENISA Technical Implementation Guidance on Commission Implementing Regulation (EU) 2024/2690, version 1.0 (June 2025), © European Union Agency for Cybersecurity (ENISA), 2025, licensed under CC BY 4.0. The section titles and requirement text are the Annex to Implementing Regulation (EU) 2024/2690 as ENISA prints it (© European Union); each section carries its first point as its text, and ENISA's guidance, examples of evidence and tips are not reproduced.