Law / Frameworks / ETSI EN 304 223 / 5.2

ETSI EN 304 223, 5.25.2.2-5

AI-specific incident management and recovery plans that are created, tested and maintained. Our summary; European Telecommunications Standards Institute (ETSI)'s text is not ours to print.

We read each law below as bearing on this provision. That does not mean the provision, done well, meets the law: what each law asks is on its own page. Law library as of 19 Oct 2026.

The kinds of duty that reach it: breach notice, reporting.

27: laws
16: jurisdictions
1: with court rulings behind it
7: not yet in force
1: proposed, not law

Related controls in other frameworks the same duties, in at least two laws we track, reach both

NIST AI RMFGOVERN 1.1 Legal and regulatory requirements involving AI are understood, managed, and..., 15 laws
NIST AI RMFMANAGE 4.3 Incidents and errors are communicated to relevant AI actors, including..., 9 laws
NIST AI RMFGOVERN 4.2 Organizational teams document the risks and potential impacts of the AI..., 8 laws
2 more in the NIST AI RMF
NIST AI 600-1GAI-RISK-09 Information Security, 27 laws
NIST AI 600-1GAI-RISK-07 Human-AI Configuration, 17 laws
NIST AI 600-1GAI-RISK-08 Information Integrity, 6 laws
NIST AI 200-22.3 Apply & Measure, 12 laws
NIST AI 200-24.3 Composing a TEVV Toolbox, 12 laws
OWASP LLM Top 10LLM03:2026 Excessive Agency, 12 laws
OWASP Agentic Top 10ASI09 Human-Agent Trust Exploitation, 13 laws
MIT mitigations4.3 Incident Reporting, 27 laws
MIT mitigations4.2 Risk Disclosure, 26 laws
MIT mitigations4.5 Third-Party System Access, 26 laws
5 more in the MIT mitigations
NIST Privacy FrameworkGV.PO-P5 Legal, regulatory, and contractual requirements regarding privacy are..., 2 laws
FINOS AIGFAIR-DET-004 AI System Observability, 27 laws
FINOS AIGFAIR-DET-021 Agent Decision Audit and Explainability, 26 laws
FINOS AIGFAIR-PREV-005 System Acceptance Testing, 12 laws
3 more in the FINOS AIGF

A law in force is unmarked; the rest wear their state: not yet in force proposed

AI governance

7 laws, 7 jurisdictions

Jurisdiction	Law	How it reaches this provision
California	Transparency in Frontier Artificial Intelligence Act (SB 53)	Through its reporting duty. What it requires
European Union	Digital Services Act, Article 37 (independent audit of very large online platforms and search engines)	Through its reporting duty. What it requires
Germany	Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act	Through its reporting duty. What it requires
Hungary	Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings	Through its reporting duty. What it requires
Illinois	Artificial Intelligence Safety Measures Act from 1 Jan 2027, in 2 months	Through its reporting duty. What it requires
South Korea	AI Framework Act, Article 32 (safety-assurance duty for high-compute AI systems)	Through its reporting duty. What it requires
United States	Artificial Intelligence Risk Management and Security Act of 2026 proposed	Through its reporting duty. What it requires

AI risk obligations

7 laws, 3 jurisdictions

Jurisdiction	Law	How it reaches this provision
Colorado	HB 26-1139 (2026), Use of Artificial Intelligence in Health Care from 1 Jan 2027, in 2 months	Through its reporting duty. What it requires
European Union	AI Act, Article 20 (corrective actions and duty of information) from 2 Dec 2027, in 13 months	Through its reporting duty. What it requires
European Union	AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring) from 2 Dec 2027, in 13 months	Through its reporting duty. What it requires
European Union	AI Act, Article 26(10) (post-remote biometric identification authorisation) from 2 Dec 2027, in 13 months	Through its reporting duty. What it requires
European Union	AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent)	Through its reporting duty. What it requires
Vietnam	Law on Artificial Intelligence, incident management and reporting obligation	Through its breach notice duty. What it requires
Vietnam	Law on Artificial Intelligence, risk classification and conformity assessment	Through its reporting duty. What it requires

AI sector rules

6 laws, 6 jurisdictions

Jurisdiction	Law	How it reaches this provision
Alabama	SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization	Through its reporting duty. What it requires
California	Employment Technological Displacement Notice (SB 951) from 1 Jan 2027, in 2 months	Through its reporting duty. What it requires
Colorado	Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models	Through its reporting duty. What it requires
European Union	MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6)	Through its reporting duty. What it requires
Jordan	Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0	Through its reporting duty. What it requires
Mauritius	Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021	Through its reporting duty. What it requires

AI transparency

5 laws, 5 jurisdictions

Jurisdiction	Law	How it reaches this provision
California	Companion Chatbot Safety and Accountability Act (SB 243)	Through its reporting duty. What it requires
Colorado	HB 26-1263 (2026), Conversational AI Service Operator Requirements	Through its reporting duty. What it requires
Gabon	Ordonnance n°0011/PR/2026, marquage des contenus générés par intelligence artificielle	Through its reporting duty. What it requires
Illinois	Artificial Intelligence Video Interview Act	Through its reporting duty. What it requires
Oregon	AI Companion Chatbot Safety Act (SB 1546) from 1 Jan 2027, in 2 months	Through its reporting duty. What it requires

AI prohibited practices

1 law, 1 jurisdiction

Jurisdiction	Law	How it reaches this provision
Monaco	Code Pénal Arts. 294-3 to 294-4, Child Sexual Abuse Material Including Realistic and AI-Generated Depictions	Through its reporting duty. What it requires

Computer misuse

1 law, 1 jurisdiction

Jurisdiction	Law	How it reaches this provision
Algeria	Loi n° 09-04 relative à la prévention et à la lutte contre les infractions liées aux technologies de l'information et de la communication	Through its reporting duty. What it requires

Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI. Every provision of the framework.