Law / Frameworks / ETSI EN 304 223 / 5.1

ETSI EN 304 223, 5.15.1.2-1

Business need and security risks written down and assessed before deciding to build an AI system. Our summary; European Telecommunications Standards Institute (ETSI)'s text is not ours to print.

We read each law below as bearing on this provision. That does not mean the provision, done well, meets the law: what each law asks is on its own page. Law library as of 19 Oct 2026.

The kinds of duty that reach it: DPIA, prohibition.

156: laws
94: jurisdictions
3: with court rulings behind them
17: not yet in force
1: blocked by a court
8: proposed, not law

Related controls in other frameworks the same duties, in at least two laws we track, reach both

NIST AI RMFMAP 3.3 Targeted application scope is specified and documented based on the system’s..., 143 laws
NIST AI RMFMAP 5.1 Likelihood and magnitude of each identified impact (both potentially..., 9 laws
NIST AI RMFMANAGE 1.3 Responses to the AI risks deemed high priority, as identified by the MAP..., 6 laws
1 more in the NIST AI RMF
NIST AI 600-1GAI-RISK-08 Information Integrity, 143 laws
NIST AI 600-1GAI-RISK-11 Obscene, Degrading, and/or Abusive Content, 143 laws
NIST AI 600-1GAI-RISK-04 Data Privacy, 13 laws
1 more in the NIST AI 600-1
NIST AI 200-22.4 Synthesize & Interrogate, 13 laws
MIT mitigations1.5 Safety Decision Frameworks, 143 laws
MIT mitigations3.3 Access Management, 143 laws
MIT mitigations1.2 Risk Management, 13 laws
3 more in the MIT mitigations
NIST Privacy FrameworkCT.PO-P1 Policies, processes, and procedures for authorizing data processing (e.g.,..., 49 laws
FINOS AIGFAIR-PREV-005 System Acceptance Testing, 156 laws
FINOS AIGFAIR-DET-021 Agent Decision Audit and Explainability, 2 laws

A law in force is unmarked; the rest wear their state: not yet in force blocked by a court proposed

AI prohibited practices

121 laws, 84 jurisdictions

Jurisdiction	Law	How it reaches this provision
Alabama	Alabama Child Protection Act of 2024, AI-Generated Child Sexual Abuse Material	Through its prohibition duty. What it requires
Arizona	AI-generated and indistinguishable depictions included in child-exploitation definitions (HB 2678)	Through its prohibition duty. What it requires
Arizona	Unlawful disclosure extended to AI-generated 'realistic pictorial representation' intimate images (SB 1462)	Through its prohibition duty. What it requires
Arkansas	Act 159 of 2025 (HB 1071), AI-Generated Replicas Amendment to Publicity Rights Act	Through its prohibition duty. What it requires
Arkansas	Act 827 of 2025 (HB 1529), Unlawful Creation or Distribution of Deepfake Visual Material	Through its prohibition duty. What it requires
Arkansas	Act 977 of 2025 (HB 1877), AI-Generated Child Sexual Abuse Material Amendments	Through its prohibition duty. What it requires
Australia	Using a Carriage Service to Transmit Sexual Material Without Consent (Deepfake Offences)	Through its prohibition duty. What it requires
Austria	StGB Section 207a(4)(4), Computer-Generated and Altered Child Sexual Abuse Material	Through its prohibition duty. What it requires
Bahamas	Sexual Offences Act, child pornography offence	Through its prohibition duty. What it requires
Bangladesh	Cyber Security Act, 2026, AI-generated sexual content and CSAM ban	Through its prohibition duty. What it requires

Show the other 111 laws

Berkeley	Prohibition on the Sale or Use of Coordinated Pricing Algorithms	Through its prohibition duty. What it requires
Bermuda	Criminal Code Act 1907, making and distributing child abusive material or child pornography	Through its prohibition duty. What it requires
Bhutan	Information, Communications and Media Act of Bhutan 2018, obscene communications depicting children	Through its prohibition duty. What it requires
Brazil	TSE Resolution, Prohibition on Electoral Deepfakes	Through its prohibition duty. What it requires
Cabo Verde	Cybercrime Law, Child Pornography Including Simulated Representations	Through its prohibition duty. What it requires
California	AI Agents and Public Participation Law (SB 1159) from 1 Jan 2027, in 2 months	Through its prohibition duty. What it requires
California	Digital Replica Likeness and Impersonation Law (SB 1111) from 1 Jan 2027, in 2 months	Through its prohibition duty. What it requires
California	Toys with Companion Chatbots Ban (SB 867) from 1 Jan 2027, in 2 months	Through its prohibition duty. What it requires
California	Workplace Surveillance Tools: AI Emotion Recognition and Neural Data Prohibition (AB 1883) from 1 Jan 2027, in 2 months	Through its prohibition duty. What it requires
Cayman Islands	Penal Code 2019 Revision, indecent photographs and pseudo-photographs of children	Through its prohibition duty. What it requires
China	Civil Code, portrait right and protection of the voice	Through its prohibition duty. What it requires
Colombia	Código Penal, Falsedad Personal, AI Deepfake Aggravation	Through its prohibition duty. What it requires
Comoros	Penal Code, pornographic and manipulated image or representation offenses via an information system	Through its prohibition duty. What it requires
Czech Republic	Criminal Code Section 181(2), Realistic Fake Depiction of a Person Made to Cause Serious Harm to Rights	Through its prohibition duty. What it requires
Czech Republic	Criminal Code Section 191a, Non-Consensual Identity-Based Pornographic Depiction	Through its prohibition duty. What it requires
Czech Republic	Criminal Code Section 192, Child Pornography Including a Depiction of a Person Who Appears to Be a Child	Through its prohibition duty. What it requires
Delaware	Child sexual abuse material offenses, computer-generated depictions	Through its prohibition duty. What it requires
Delaware	House Bill 191 (2026), medical professional title protection against nonhuman and AI entities	Through its prohibition duty. What it requires
Delaware	House Bill 353 (2024), deep fake intimate images (The Amelia Kramer Act)	Through its prohibition duty. What it requires
Denmark	Lov nr. 467 af 14. maj 2025, National Competent Authorities and Article 5 Enforcement	Through its prohibition duty. What it requires
European Union	AI Act, Article 5 (prohibited AI practices)	Through its prohibition duty. What it requires
European Union	AI Act, Article 5(1)(ba) and (bb) (AI-generated non-consensual intimate imagery and child sexual abuse material) from 2 Dec 2026, in 6 weeks	Through its prohibition duty. What it requires
European Union	Commission Guidelines on prohibited AI practices under the AI Act (C(2025) 5052 final)	Through its prohibition duty. What it requires
Finland	Rikoslaki Chapter 20, Distribution and Possession of an Image Depicting a Child Sexually, Including Realistic Depictions	Through its prohibition duty. What it requires
France	Code Pénal Article 226-8 as Amended, Existing Offense Extended to Algorithmically Generated Content	Through its prohibition duty. What it requires
France	Code Pénal Article 226-8-1, Non-Consensual Sexual Montage and Algorithmically Generated Sexual Content	Through its prohibition duty. What it requires
Gabon	Ordonnance n°0011/PR/2026, contenus interdits générés par intelligence artificielle	Through its prohibition duty. What it requires
Hoboken	Ord. No. B-781, Algorithmic Rent Fixing in Rental Housing Market Prohibited	Through its prohibition duty. What it requires
Hungary	Büntető Törvénykönyv (Criminal Code), Section 204(8), Realistic Depiction of a Non-Existent Person as Child Pornography	Through its prohibition duty. What it requires
Idaho	Disclosing explicit synthetic media	Through its prohibition duty. What it requires
Illinois	Child sexual abuse material, computer-generated and digitally altered depictions	Through its prohibition duty. What it requires
Illinois	Civil Remedies for Nonconsensual Dissemination of Private Sexual Images Act, digitally altered images	Through its prohibition duty. What it requires
Illinois	Right of Publicity Act, unauthorized AI digital replica prohibition	Through its prohibition duty. What it requires
Indiana	Child Exploitation and Possession of Child Pornography, obscene simulated or computer-generated images	Through its prohibition duty. What it requires
Indiana	Distribution of an Intimate Image and Civil Action for Nonconsensual Pornography, extended to AI-generated images (House Enrolled Act 1047, 2024)	Through its prohibition duty. What it requires
Iowa	Harassment, nonconsensual and synthetic intimate images	Through its prohibition duty. What it requires
Iowa	Sexual exploitation of a minor, AI-generated and manipulated depictions	Through its prohibition duty. What it requires
Ireland	Protection of Voice and Image Bill 2025 (Bill No. 11 of 2025), Offences for Misuse of a Name, Photograph, Voice or Likeness proposed	Through its prohibition duty. What it requires
Italy	Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13)	Through its DPIA duty. What it requires
Jersey City	Ordinance 25-057, Preventing Algorithmic Rent-Fixing in the Rental Housing Market	Through its prohibition duty. What it requires
Jordan	Cybercrime Law, Ban on Real, Virtual, and Simulated Depictions of a Minor	Through its prohibition duty. What it requires
Kosovo	Criminal Code of the Republic of Kosovo, Articles 225 and 232 (Child Pornography, Including Computer-Generated and Non-Existent-Child Images)	Through its prohibition duty. What it requires
Latvia	Krimināllikums Sections 90.1 and 90.2, Criminalization of Deepfake Election and State-Appointment Disinformation	Through its prohibition duty. What it requires
Lithuania	Criminal Code Art. 309(2), Dealing in Child Sexual Abuse Material Including Simulated Depictions	Through its prohibition duty. What it requires
Louisiana	Act 496 (SB 346), deepfake material used against K-12 students	Through its prohibition duty. What it requires
Maine	Unauthorized dissemination of certain private images (AI-generated image amendment)	Through its prohibition duty. What it requires
Malta	Criminal Code, Article 208A, Indecent Material Involving Persons Under Age Including Digitally Created and Non-Existent Minors	Through its prohibition duty. What it requires
Mexico	Código Penal Federal, Violación a la Intimidad Sexual (Arts. 199 Octies a 199 Decies), including manipulated or non-corresponding depictions	Through its prohibition duty. What it requires
Michigan	Protection from Intimate Deep Fakes Act (Public Act 11 of 2025)	Through its prohibition duty. What it requires
Minneapolis	Prohibition on Use of Rent-Setting Algorithms (Ord. No. 2025-010)	Through its prohibition duty. What it requires
Mississippi	HB 1308 (2025), Morphed-Image Child Exploitation Amendments	Through its prohibition duty. What it requires
Monaco	Code Pénal Arts. 294-3 to 294-4, Child Sexual Abuse Material Including Realistic and AI-Generated Depictions	Through its prohibition duty. What it requires
Montana	Digital Likeness and Voice Rights Act (HB 513, 2025), unauthorized AI depiction liability	Through its prohibition duty. What it requires
Montana	Privacy in communications, digitally fabricated intimate images	Through its prohibition duty. What it requires
Montana	Sexual abuse of children, computer-generated child pornography	Through its prohibition duty. What it requires
Nebraska	Child Sexual Abuse Material Prevention Act, computer-generated and artificial-intelligence depictions	Through its prohibition duty. What it requires
Nevada	AB 406 (2025), AI mental and behavioral health care provider and marketing prohibitions	Through its prohibition duty. What it requires
Nevada	SB 213 (2025), AI-generated and digitally altered intimate images	Through its prohibition duty. What it requires
Nevada	SB 263 (2025), AI-generated and computer-generated child sexual abuse material	Through its prohibition duty. What it requires
New Jersey	Deceptive Audio or Visual Media (Deepfake) Criminalization Act	Through its prohibition duty. What it requires
New Mexico	Sexual Exploitation of Children Act, morphed and computer-generated image provisions	Through its prohibition duty. What it requires
New York	Right of privacy, use of a living person's name, portrait, picture, likeness, or voice for advertising or trade	Through its prohibition duty. What it requires
North Carolina	AI-Generated Intimate Images and Child Sexual Abuse Material (Session Law 2024-37, HB 591)	Through its prohibition duty. What it requires
North Dakota	House Bill 1351 (2025), sexually expressive images including AI-generated or altered deepfakes	Through its prohibition duty. What it requires
North Dakota	House Bill 1429 (2025), harassment and stalking with a robot	Through its prohibition duty. What it requires
Ohio	S.B. 163, AI-Generated Child Sexual Abuse Material and Nonconsensual Replica Prohibitions proposed	Through its prohibition duty. What it requires
Oklahoma	HB 1364 (2025), nonconsensual dissemination of artificially generated sexual depictions	Through its prohibition duty. What it requires
Oregon	Unlawful dissemination of an intimate image extended to AI-generated depictions (HB 2299)	Through its prohibition duty. What it requires
Pennsylvania	Act 125 of 2024, artificially generated child sexual abuse material	Through its prohibition duty. What it requires
Pennsylvania	Act 125 of 2024, artificially generated sexual depictions in the unlawful dissemination of intimate image offense	Through its prohibition duty. What it requires
Pennsylvania	Act 35 of 2025, digital forgery	Through its prohibition duty. What it requires
Peru	Reglamento de la Ley 31814, prohibited AI uses	Through its prohibition duty. What it requires
Philadelphia	Bill No. 240823, Anti-Competitive Rental Practices	Through its prohibition duty. What it requires
Poland	Kodeks karny art. 202 § 4b-4c, Fabricated Child Sexual Abuse Material	Through its prohibition duty. What it requires
Providence	Prohibition of Algorithmic Rent Setting Devices	Through its prohibition duty. What it requires
Rockville	Price Coordination and Algorithmic Devices from 1 Jan 2027, in 2 months	Through its prohibition duty. What it requires
Romania	Cod penal, Art. 374, Pornografia infantilă (Child Pornography, Including Simulated or Computer-Generated Depictions of Minors)	Through its prohibition duty. What it requires
Saint Kitts and Nevis	Electronic Crimes Act, child pornography, including computer-generated depictions	Through its prohibition duty. What it requires
Samoa	Crimes Act 2013, child pornography offence reaching synthetic and represented depictions	Through its prohibition duty. What it requires
San Diego	Prohibition of Anti-Competitive Automated Rent Price-Fixing Ordinance (Ord. O-21955 N.S.)	Through its prohibition duty. What it requires
San Francisco	Use and Sale of Algorithmic Devices Prohibited (Rent Ordinance Sec. 37.10C), as amended by Ord. No. 169-25	Through its prohibition duty. What it requires
Santa Monica	Algorithmic Rental Price Fixing (Ord. No. 2817 (CCS))	Through its prohibition duty. What it requires
Seattle	Ordinance 127241 (Council Bill 121000), Algorithmic Rent Fixing	Through its prohibition duty. What it requires
Slovenia	Kazenski zakonik (KZ-1, Criminal Code), Art. 176(3), Pornographic Material Involving a Minor's Realistic Likeness	Through its prohibition duty. What it requires
South Carolina	AI-Generated and Morphed Images of an Identifiable Minor (2025 Act No. 58, S.29)	Through its prohibition duty. What it requires
Sweden	Brottsbalken 16 kap. 10 a-10 b §§, Child Pornography Offence (Barnpornografibrott)	Through its prohibition duty. What it requires
Tennessee	AI-generated child sexual abuse material, tool possession and distribution offense	Through its prohibition duty. What it requires
Tennessee	Ensuring Likeness, Voice, and Image Security (ELVIS) Act	Through its prohibition duty. What it requires
Tennessee	Preventing Deepfake Images Act	Through its prohibition duty. What it requires
Texas	Political deep fake video ban (originally S.B. 751, 2019)	Through its prohibition duty. What it requires
Texas	S.B. 20 (2025), possession, promotion, or production of AI-generated or apparent child pornography	Through its prohibition duty. What it requires
Texas	S.B. 441 (2025), unlawful production or distribution of AI deep fake sexually explicit media	Through its prohibition duty. What it requires
Texas	TRAIGA (H.B. 149, 2025), prohibited AI practices binding any person	Through its prohibition duty. What it requires
Timor-Leste	Penal Code, Article 176 (Child Pornography)	Through its prohibition duty. What it requires
Turkey	Commercial Advertising Regulation, AI Deepfake Endorsement Ban	Through its prohibition duty. What it requires
United Kingdom	Making or Supplying a Generator of Purported Intimate Images	Through its prohibition duty. What it requires
United Kingdom	Making, Adapting, Possessing or Supplying a Child Sexual Abuse Image-Generator, England and Wales from a date not yet set	Through its prohibition duty. What it requires
United Kingdom	Making, Adapting, Possessing or Supplying a Child Sexual Abuse Image-Generator, Northern Ireland from a date not yet set	Through its prohibition duty. What it requires
United Kingdom	Making, Adapting, Possessing or Supplying a Child Sexual Abuse Image-Generator, Scotland from a date not yet set	Through its prohibition duty. What it requires
United Kingdom	Possession of Advice or Guidance About Abusing Children Sexually or Creating CSA Images, England and Wales and Northern Ireland from a date not yet set	Through its prohibition duty. What it requires
United Kingdom	Possession of Advice or Guidance About Abusing Children Sexually or Creating CSA Images, Scotland from a date not yet set	Through its prohibition duty. What it requires
United States	Obscene visual representations of the sexual abuse of children, and the definition of child pornography, as they reach computer-generated images	Through its prohibition duty. What it requires
Utah	Digital Voyeurism Prevention Act (HB 276, 2026 General Session), Utah Code Title 13 Chapter 72b from 1 Jan 2027, in 2 months	Through its prohibition duty. What it requires
Utah	Identity Protection Modifications, AI Defamation and Identity Replication (SB 256, 2026 General Session)	Through its prohibition duty. What it requires
Vatican City	Child sexual abuse material offences (Legge N. VIII, arts. 4, 10-11)	Through its prohibition duty. What it requires
Vermont	Disclosure of sexually explicit images without consent, digitized and computer-generated images	Through its prohibition duty. What it requires
West Virginia	SB 198 (2025), computer-generated child pornography prohibition	Through its prohibition duty. What it requires
West Virginia	SB 198 (2025), fabricated intimate image disclosure prohibition	Through its prohibition duty. What it requires
Wisconsin	2023 Wisconsin Act 224, Possession of Virtual Child Pornography	Through its prohibition duty. What it requires
Wisconsin	2025 Wisconsin Act 34, Synthetic Intimate Representation Ban	Through its prohibition duty. What it requires
Wyoming	Artificial Intelligence Offenses (2026 Wyoming House Bill 102, Enrolled Act No. 32)	Through its prohibition duty. What it requires

AI sector rules

11 laws, 10 jurisdictions

Jurisdiction	Law	How it reaches this provision
California	Attorney, Court Filing and Arbitrator Generative AI Duties (SB 574) from 1 Jan 2027, in 2 months	Through its prohibition duty. What it requires
California	Health Care Services Artificial Intelligence Act (AB 1979) from 1 Jan 2027, in 2 months	Through its prohibition duty. What it requires
Colorado	HB 26-1195 (2026), Psychotherapy Artificial Intelligence Restrictions	Through its prohibition duty. What it requires
France	Law 2023-380, Article 10, Experimental Algorithmic Processing of Video-Protection Images, Extended to 31 December 2030	Through its prohibition duty. What it requires
Illinois	Wellness and Oversight for Psychological Resources Act	Through its prohibition duty. What it requires
Maine	Use of artificial intelligence in therapy or psychotherapy services	Through its prohibition duty. What it requires
Mauritius	FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services	Through its DPIA duty. What it requires
Mexico	Reform to the Federal Labor Law and the Federal Copyright Law, AI Voice and Image Consent Regime for Performing Artists	Through its prohibition duty. What it requires
Nevada	AB 406 (2025), licensed provider restriction on direct clinical use of AI	Through its prohibition duty. What it requires
Oregon	Use of nursing titles by a nonhuman entity (HB 2748)	Through its prohibition duty. What it requires

Show the other 1 law

Tennessee

Health Care AI Act, AI mental health professional representation prohibition

Through its prohibition duty. What it requires

AI governance

9 laws, 9 jurisdictions

Jurisdiction	Law	How it reaches this provision
Andorra	Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra proposed	Through its DPIA duty. What it requires
Armenia	Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia proposed	Through its DPIA duty. What it requires
Canada	Council of Europe Framework Convention on Artificial Intelligence, signed by Canada proposed	Through its DPIA duty. What it requires
El Salvador	Ley de Fomento a la Inteligencia Artificial y Tecnologías, marco institucional, registro y evaluación de riesgos	Through its DPIA duty. What it requires
European Union	AI Act, Article 26(9) (using Article 13 information for a data protection impact assessment) from 2 Dec 2027, in 13 months	Through its DPIA duty. What it requires
Latvia	Law on Digital Operational Resilience of the Financial Market and the Use of Artificial Intelligence, Articles 7, 8(5)-(7), 10(3)-(4) and 11(2)	Through its prohibition duty. What it requires
Moldova	Council of Europe Framework Convention on Artificial Intelligence, signed by Moldova proposed	Through its DPIA duty. What it requires
United Kingdom	Council of Europe Framework Convention on Artificial Intelligence, signed by the United Kingdom proposed	Through its DPIA duty. What it requires
Vatican City	Guidelines on Artificial Intelligence of Vatican City State (Decree No. DCCII)	Through its prohibition duty. What it requires

AI transparency

9 laws, 9 jurisdictions

Jurisdiction	Law	How it reaches this provision
Belize	Practice Direction No. 18 of 2025, ethical use of generative AI in court proceedings	Through its prohibition duty. What it requires
California	AB 2839, election materially deceptive deepfake disclaimer law blocked by a court	Through its prohibition duty. What it requires
Delaware	House Bill 316 (2024), use of deep fake technology to influence an election	Through its prohibition duty. What it requires
Michigan	Distribution of Materially Deceptive Election Media (Public Act 265 of 2023)	Through its prohibition duty. What it requires
Mississippi	SB 2577 (2024), Wrongful Dissemination of Digitizations (Election Deepfakes)	Through its prohibition duty. What it requires
Montana	Deepfake Regulation Act (SB 25, 2025), election deepfake disclosure	Through its prohibition duty. What it requires
New Mexico	HB 182 (2024), AI-generated and manipulated media disclosure and disclaimer requirements in campaign advertising	Through its prohibition duty. What it requires
Pennsylvania	H.B. 811, civil liability for fraudulent misrepresentation of candidates by deepfake proposed	Through its prohibition duty. What it requires
Vermont	Vermont Synthetic Media in Elections Act	Through its prohibition duty. What it requires

AI risk obligations

4 laws, 4 jurisdictions

Jurisdiction	Law	How it reaches this provision
Colorado	HB 26-1139 (2026), Use of Artificial Intelligence in Health Care from 1 Jan 2027, in 2 months	Through its prohibition duty. What it requires
European Union	AI Act, Article 27 (fundamental rights impact assessment) from 2 Dec 2027, in 13 months	Through its DPIA duty. What it requires
Italy	Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10)	Through its DPIA duty. What it requires
Kyrgyzstan	Digital Code, Chapter 23: AI system design and risk-management obligations	Through its DPIA duty. What it requires

AI training data

1 law, 1 jurisdiction

Jurisdiction	Law	How it reaches this provision
Hungary	Act XLVII of 1997 on Health Data, Section 35/A(4) to (8), Conditions for AI Development on Electronic Health Service Space Data	Through its DPIA duty. What it requires

Computer misuse

1 law, 1 jurisdiction

Jurisdiction	Law	How it reaches this provision
Tuvalu	Tuvalu Telecommunications Corporation Act 1993, offences and penalties	Through its prohibition duty. What it requires

Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI. Every provision of the framework.