Law / Frameworks / Crosswalk / ETSI EN 304 223 to MIT mitigations

The ETSI EN 304 223, Baseline Cyber Security Requirements for AI Models and Systems, mapped to the MIT AI Risk Mitigation Taxonomy

19 of ETSI EN 304 223's provisions connect to 18 of MIT mitigations' through 436 laws in 166 jurisdictions. Two provisions connect when the same duties, in at least 2 laws we track, reach both. The connections are our own reading of the law; no framework publisher has reviewed or endorsed them.

From: ETSI EN 304 223, Baseline Cyber Security Requirements for AI Models and Systems, version 2.1.1, December 2025, European Telecommunications Standards Institute (ETSI)
To: MIT AI Risk Mitigation Taxonomy, preliminary taxonomy, July 2025, MIT AI Risk Initiative
See also: MIT mitigations to ETSI EN 304 223, the other way · every pair in the crosswalk · law library as of 19 Oct 2026

Download this mapping, with every law behind each connection: mit-ai-risk-mitigations--etsi-en-304-223.csv · mit-ai-risk-mitigations--etsi-en-304-223.json

ETSI EN 304 223	MIT mitigations	Laws	Jurisdictions	Where the laws stand
5.1.2-1Business need and security risks written down and assessed before deciding to build an...	1.5Safety Decision Frameworks	143	86	124 in force, 15 not yet in force, 1 blocked by a court, 3 proposed
	The 143 laws behind 5.1.2-1 and 1.5 Alabama Child Protection Act of 2024, AI-Generated Child Sexual Abuse Material, Alabama AI-generated and indistinguishable depictions included in child-exploitation definitions (HB 2678), Arizona Unlawful disclosure extended to AI-generated 'realistic pictorial representation' intimate images (SB 1462), Arizona Act 159 of 2025 (HB 1071), AI-Generated Replicas Amendment to Publicity Rights Act, Arkansas Act 827 of 2025 (HB 1529), Unlawful Creation or Distribution of Deepfake Visual Material, Arkansas Act 977 of 2025 (HB 1877), AI-Generated Child Sexual Abuse Material Amendments, Arkansas Using a Carriage Service to Transmit Sexual Material Without Consent (Deepfake Offences), Australia StGB Section 207a(4)(4), Computer-Generated and Altered Child Sexual Abuse Material, Austria Sexual Offences Act, child pornography offence, Bahamas Cyber Security Act, 2026, AI-generated sexual content and CSAM ban, Bangladesh and 133 more, every one in the free file.
	3.3Access Management	143	86	124 in force, 15 not yet in force, 1 blocked by a court, 3 proposed
	The 143 laws behind 5.1.2-1 and 3.3 Alabama Child Protection Act of 2024, AI-Generated Child Sexual Abuse Material, Alabama AI-generated and indistinguishable depictions included in child-exploitation definitions (HB 2678), Arizona Unlawful disclosure extended to AI-generated 'realistic pictorial representation' intimate images (SB 1462), Arizona Act 159 of 2025 (HB 1071), AI-Generated Replicas Amendment to Publicity Rights Act, Arkansas Act 827 of 2025 (HB 1529), Unlawful Creation or Distribution of Deepfake Visual Material, Arkansas Act 977 of 2025 (HB 1877), AI-Generated Child Sexual Abuse Material Amendments, Arkansas Using a Carriage Service to Transmit Sexual Material Without Consent (Deepfake Offences), Australia StGB Section 207a(4)(4), Computer-Generated and Altered Child Sexual Abuse Material, Austria Sexual Offences Act, child pornography offence, Bahamas Cyber Security Act, 2026, AI-generated sexual content and CSAM ban, Bangladesh and 133 more, every one in the free file.
	1.2Risk Management	13	11	6 in force, 2 not yet in force, 5 proposed
	The 13 laws behind 5.1.2-1 and 1.2 Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Canada, Canada proposed Ley de Fomento a la Inteligencia Artificial y Tecnologías, marco institucional, registro y evaluación de riesgos, El Salvador AI Act, Article 26(9) (using Article 13 information for a data protection impact assessment), European Union from 2 Dec 2027, in 13 months AI Act, Article 27 (fundamental rights impact assessment), European Union from 2 Dec 2027, in 13 months Act XLVII of 1997 on Health Data, Section 35/A(4) to (8), Conditions for AI Development on Electronic Health Service Space Data, Hungary Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan and 3 more, every one in the free file.
	1.7Societal Impact Assessment	13	11	6 in force, 2 not yet in force, 5 proposed
	The 13 laws behind 5.1.2-1 and 1.7 Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Canada, Canada proposed Ley de Fomento a la Inteligencia Artificial y Tecnologías, marco institucional, registro y evaluación de riesgos, El Salvador AI Act, Article 26(9) (using Article 13 information for a data protection impact assessment), European Union from 2 Dec 2027, in 13 months AI Act, Article 27 (fundamental rights impact assessment), European Union from 2 Dec 2027, in 13 months Act XLVII of 1997 on Health Data, Section 35/A(4) to (8), Conditions for AI Development on Electronic Health Service Space Data, Hungary Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan and 3 more, every one in the free file.
	3.1Testing & Auditing	13	11	6 in force, 2 not yet in force, 5 proposed
	The 13 laws behind 5.1.2-1 and 3.1 Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Canada, Canada proposed Ley de Fomento a la Inteligencia Artificial y Tecnologías, marco institucional, registro y evaluación de riesgos, El Salvador AI Act, Article 26(9) (using Article 13 information for a data protection impact assessment), European Union from 2 Dec 2027, in 13 months AI Act, Article 27 (fundamental rights impact assessment), European Union from 2 Dec 2027, in 13 months Act XLVII of 1997 on Health Data, Section 35/A(4) to (8), Conditions for AI Development on Electronic Health Service Space Data, Hungary Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan and 3 more, every one in the free file.
	4.1System Documentation	2	2	1 in force, 1 not yet in force
	The 2 laws behind 5.1.2-1 and 4.1 Attorney, Court Filing and Arbitrator Generative AI Duties (SB 574), California from 1 Jan 2027, in 2 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy
5.1.2-2System built to hold up against adversarial attacks, unexpected inputs and failures.	2.1Model & Infrastructure Security	3	2	2 in force, 1 not yet in force
	The 3 laws behind 5.1.2-2 and 2.1 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	2.3Model Safety Engineering	3	2	2 in force, 1 not yet in force
	The 3 laws behind 5.1.2-2 and 2.3 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	3.1Testing & Auditing	3	2	2 in force, 1 not yet in force
	The 3 laws behind 5.1.2-2 and 3.1 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	3.6Incident Response & Recovery	3	2	2 in force, 1 not yet in force
	The 3 laws behind 5.1.2-2 and 3.6 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.	2.1Model & Infrastructure Security	145	107	142 in force, 3 not yet in force
	The 145 laws behind 5.1.2-6 and 2.1 Penal Code, Part Twelve, Chapter One (Cyber Crimes and Punishment), Afghanistan Alabama Digital Crime Act, Computer Tampering, Alabama Criminal mischief in the fourth degree, unauthorized computer access, Alaska Criminal use of a computer, Alaska Theft of services, unauthorized use of a computer system, Alaska Copyright Law, Sui Generis Database Producers Rights, Albania Criminal Code, Unauthorized Computer Access, Albania Code pénal, atteintes aux systèmes de traitement automatisé de données, Algeria Ordonnance n° 03-05, exception de citation, Algeria Ordonnance n° 03-05, protection des bases de données, Algeria and 135 more, every one in the free file.
	3.2Data Governance	145	107	142 in force, 3 not yet in force
	The 145 laws behind 5.1.2-6 and 3.2 Penal Code, Part Twelve, Chapter One (Cyber Crimes and Punishment), Afghanistan Alabama Digital Crime Act, Computer Tampering, Alabama Criminal mischief in the fourth degree, unauthorized computer access, Alaska Criminal use of a computer, Alaska Theft of services, unauthorized use of a computer system, Alaska Copyright Law, Sui Generis Database Producers Rights, Albania Criminal Code, Unauthorized Computer Access, Albania Code pénal, atteintes aux systèmes de traitement automatisé de données, Algeria Ordonnance n° 03-05, exception de citation, Algeria Ordonnance n° 03-05, protection des bases de données, Algeria and 135 more, every one in the free file.
	4.1System Documentation	2	2	2 in force
	The 2 laws behind 5.1.2-6 and 4.1 Copyright Act 2013, economic rights, computer program copying, and technological protection measures, Cook Islands Schutz technischer Massnahmen und Durchsetzung von Schrankenbestimmungen (Protection of Technological Measures), Germany
5.1.2-7Due diligence on external providers, including whether they follow this standard.	3.3Access Management	2	2	1 in force, 1 not yet in force
	The 2 laws behind 5.1.2-7 and 3.3 AI Act, Article 25 (responsibilities along the AI value chain), European Union from 2 Dec 2027, in 13 months Reform to the Federal Labor Law and the Federal Copyright Law, AI Voice and Image Consent Regime for Performing Artists, Mexico
5.1.3-1Threat modelling and risk management, reviewed regularly and covering AI-specific attacks.	3.1Testing & Auditing	16	11	8 in force, 3 not yet in force, 5 proposed
	The 16 laws behind 5.1.3-1 and 3.1 Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Canada, Canada proposed Ley de Fomento a la Inteligencia Artificial y Tecnologías, marco institucional, registro y evaluación de riesgos, El Salvador AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(9) (using Article 13 information for a data protection impact assessment), European Union from 2 Dec 2027, in 13 months AI Act, Article 27 (fundamental rights impact assessment), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Act XLVII of 1997 on Health Data, Section 35/A(4) to (8), Conditions for AI Development on Electronic Health Service Space Data, Hungary Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy and 6 more, every one in the free file.
	1.2Risk Management	14	11	7 in force, 2 not yet in force, 5 proposed
	The 14 laws behind 5.1.3-1 and 1.2 Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Canada, Canada proposed Ley de Fomento a la Inteligencia Artificial y Tecnologías, marco institucional, registro y evaluación de riesgos, El Salvador AI Act, Article 26(9) (using Article 13 information for a data protection impact assessment), European Union from 2 Dec 2027, in 13 months AI Act, Article 27 (fundamental rights impact assessment), European Union from 2 Dec 2027, in 13 months Act XLVII of 1997 on Health Data, Section 35/A(4) to (8), Conditions for AI Development on Electronic Health Service Space Data, Hungary Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy and 4 more, every one in the free file.
	1.7Societal Impact Assessment	13	11	6 in force, 2 not yet in force, 5 proposed
	The 13 laws behind 5.1.3-1 and 1.7 Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Canada, Canada proposed Ley de Fomento a la Inteligencia Artificial y Tecnologías, marco institucional, registro y evaluación de riesgos, El Salvador AI Act, Article 26(9) (using Article 13 information for a data protection impact assessment), European Union from 2 Dec 2027, in 13 months AI Act, Article 27 (fundamental rights impact assessment), European Union from 2 Dec 2027, in 13 months Act XLVII of 1997 on Health Data, Section 35/A(4) to (8), Conditions for AI Development on Electronic Health Service Space Data, Hungary Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan and 3 more, every one in the free file.
	2.1Model & Infrastructure Security	3	2	2 in force, 1 not yet in force
	The 3 laws behind 5.1.3-1 and 2.1 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	2.3Model Safety Engineering	3	2	2 in force, 1 not yet in force
	The 3 laws behind 5.1.3-1 and 2.3 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	3.6Incident Response & Recovery	3	2	2 in force, 1 not yet in force
	The 3 laws behind 5.1.3-1 and 3.6 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	1.1Board Structure & Oversight	2	1	2 in force
	The 2 laws behind 5.1.3-1 and 1.1 Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy
	3.5Post-deployment Monitoring	2	1	2 in force
	The 2 laws behind 5.1.3-1 and 3.5 Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy
	4.1System Documentation	2	1	2 in force
	The 2 laws behind 5.1.3-1 and 4.1 Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy
5.1.3-2Threats developers cannot resolve are passed to operators and on to end-users.	4.1System Documentation	70	44	42 in force, 16 not yet in force, 12 proposed
	The 70 laws behind 5.1.3-2 and 4.1 Distribution of Materially Deceptive Media to Influence an Upcoming Election, Alabama SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Practice Direction No. 18 of 2025, ethical use of generative AI in court proceedings, Belize Attorney, Court Filing and Arbitrator Generative AI Duties (SB 574), California from 1 Jan 2027, in 2 months California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), California CCPA Automated Decisionmaking Technology Regulations, California Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Companion Chatbot Safety and Accountability Act (SB 243), California and 60 more, every one in the free file.
	4.2Risk Disclosure	70	44	42 in force, 16 not yet in force, 12 proposed
	The 70 laws behind 5.1.3-2 and 4.2 Distribution of Materially Deceptive Media to Influence an Upcoming Election, Alabama SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Practice Direction No. 18 of 2025, ethical use of generative AI in court proceedings, Belize Attorney, Court Filing and Arbitrator Generative AI Duties (SB 574), California from 1 Jan 2027, in 2 months California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), California CCPA Automated Decisionmaking Technology Regulations, California Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Companion Chatbot Safety and Accountability Act (SB 243), California and 60 more, every one in the free file.
	4.6User Rights & Recourse	70	44	42 in force, 16 not yet in force, 12 proposed
	The 70 laws behind 5.1.3-2 and 4.6 Distribution of Materially Deceptive Media to Influence an Upcoming Election, Alabama SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Practice Direction No. 18 of 2025, ethical use of generative AI in court proceedings, Belize Attorney, Court Filing and Arbitrator Generative AI Duties (SB 574), California from 1 Jan 2027, in 2 months California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), California CCPA Automated Decisionmaking Technology Regulations, California Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Companion Chatbot Safety and Accountability Act (SB 243), California and 60 more, every one in the free file.
	2.4Content Safety Controls	23	19	14 in force, 5 not yet in force, 4 proposed
	The 23 laws behind 5.1.3-2 and 2.4 Distribution of Materially Deceptive Media to Influence an Upcoming Election, Alabama California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), California Synthetic Performer Advertising Disclosure Act (SB 1050), California from 1 Jan 2027, in 2 months AI Act, Article 50 (transparency obligations for AI systems and synthetic content), European Union European Commission Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of the AI Act, European Union from a date not yet set Use of Digitally Altered Media in Elections (House Enrolled Act 1133, 2024), Indiana Synthetic Media Disclosure in Electioneering Communications, Kentucky Digital Code, Chapter 23: AI interaction and deepfake disclosure duties, Kyrgyzstan AI-Generated Political Advertisement and Robocall Disclosure (Public Act 263 of 2023), Michigan Conversational Artificial Intelligence Safety Act (LB 525, §§ 12-18), Nebraska from 1 Jul 2027, in 8 months and 13 more, every one in the free file.
	4.3Incident Reporting	6	4	3 in force, 3 not yet in force
	The 6 laws behind 5.1.3-2 and 4.3 Employment Technological Displacement Notice (SB 951), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Artificial Intelligence Video Interview Act, Illinois Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months
	4.5Third-Party System Access	6	4	3 in force, 3 not yet in force
	The 6 laws behind 5.1.3-2 and 4.5 Employment Technological Displacement Notice (SB 951), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Artificial Intelligence Video Interview Act, Illinois Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months
	1.1Board Structure & Oversight	2	2	2 in force
	The 2 laws behind 5.1.3-2 and 1.1 Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
	1.2Risk Management	2	2	2 in force
	The 2 laws behind 5.1.3-2 and 1.2 Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
	3.2Data Governance	2	2	1 in force, 1 not yet in force
	The 2 laws behind 5.1.3-2 and 3.2 Consumer Credit Act, Articles 24 and 30, Personalised Offers and Creditworthiness Assessment by Automated Processing, Croatia from 20 Nov 2026, in 4 weeks Artificial Intelligence Video Interview Act, Illinois
	3.5Post-deployment Monitoring	2	2	2 in force
	The 2 laws behind 5.1.3-2 and 3.5 Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
5.1.4-1Capability for human oversight designed in and maintained.	1.1Board Structure & Oversight	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 5.1.4-1 and 1.1 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	1.2Risk Management	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 5.1.4-1 and 1.2 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	3.5Post-deployment Monitoring	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 5.1.4-1 and 3.5 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	4.1System Documentation	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 5.1.4-1 and 4.1 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	4.2Risk Disclosure	15	11	11 in force, 3 not yet in force, 1 proposed
	The 15 laws behind 5.1.4-1 and 4.2 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica and 5 more, every one in the free file.
	4.3Incident Reporting	12	9	9 in force, 2 not yet in force, 1 proposed
	The 12 laws behind 5.1.4-1 and 4.3 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius and 2 more, every one in the free file.
	4.5Third-Party System Access	12	9	9 in force, 2 not yet in force, 1 proposed
	The 12 laws behind 5.1.4-1 and 4.5 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius and 2 more, every one in the free file.
	3.2Data Governance	6	3	4 in force, 2 not yet in force
	The 6 laws behind 5.1.4-1 and 3.2 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Use of artificial intelligence in therapy or psychotherapy services, Maine
	3.3Access Management	4	2	2 in force, 2 not yet in force
	The 4 laws behind 5.1.4-1 and 3.3 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy
	4.4Governance Disclosure	3	3	2 in force, 1 not yet in force
	The 3 laws behind 5.1.4-1 and 4.4 AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius Digital Transformation Act 2025, ICT service permit for AI and AI-related data services, Vanuatu
	4.6User Rights & Recourse	2	2	2 in force
	The 2 laws behind 5.1.4-1 and 4.6 Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
	3.1Testing & Auditing	2	1	2 in force
	The 2 laws behind 5.1.4-1 and 3.1 Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy
5.1.4-3Where oversight is a risk control, the technical measures behind it are built,...	3.2Data Governance	5	3	3 in force, 2 not yet in force
	The 5 laws behind 5.1.4-3 and 3.2 Loi n° 24.001 portant protection des données à caractère personnel, collecte de données publiquement accessibles et transfert transfrontalier, Central African Republic AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy
	3.3Access Management	5	3	3 in force, 2 not yet in force
	The 5 laws behind 5.1.4-3 and 3.3 Loi n° 24.001 portant protection des données à caractère personnel, collecte de données publiquement accessibles et transfert transfrontalier, Central African Republic AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy
	1.1Board Structure & Oversight	4	2	2 in force, 2 not yet in force
	The 4 laws behind 5.1.4-3 and 1.1 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy
	1.2Risk Management	4	2	2 in force, 2 not yet in force
	The 4 laws behind 5.1.4-3 and 1.2 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy
	3.5Post-deployment Monitoring	4	2	2 in force, 2 not yet in force
	The 4 laws behind 5.1.4-3 and 3.5 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy
	4.1System Documentation	4	2	2 in force, 2 not yet in force
	The 4 laws behind 5.1.4-3 and 4.1 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy
5.1.4-5End-users told which uses of the system are prohibited.	1.5Safety Decision Frameworks	143	86	124 in force, 15 not yet in force, 1 blocked by a court, 3 proposed
	The 143 laws behind 5.1.4-5 and 1.5 Alabama Child Protection Act of 2024, AI-Generated Child Sexual Abuse Material, Alabama AI-generated and indistinguishable depictions included in child-exploitation definitions (HB 2678), Arizona Unlawful disclosure extended to AI-generated 'realistic pictorial representation' intimate images (SB 1462), Arizona Act 159 of 2025 (HB 1071), AI-Generated Replicas Amendment to Publicity Rights Act, Arkansas Act 827 of 2025 (HB 1529), Unlawful Creation or Distribution of Deepfake Visual Material, Arkansas Act 977 of 2025 (HB 1877), AI-Generated Child Sexual Abuse Material Amendments, Arkansas Using a Carriage Service to Transmit Sexual Material Without Consent (Deepfake Offences), Australia StGB Section 207a(4)(4), Computer-Generated and Altered Child Sexual Abuse Material, Austria Sexual Offences Act, child pornography offence, Bahamas Cyber Security Act, 2026, AI-generated sexual content and CSAM ban, Bangladesh and 133 more, every one in the free file.
	3.3Access Management	143	86	124 in force, 15 not yet in force, 1 blocked by a court, 3 proposed
	The 143 laws behind 5.1.4-5 and 3.3 Alabama Child Protection Act of 2024, AI-Generated Child Sexual Abuse Material, Alabama AI-generated and indistinguishable depictions included in child-exploitation definitions (HB 2678), Arizona Unlawful disclosure extended to AI-generated 'realistic pictorial representation' intimate images (SB 1462), Arizona Act 159 of 2025 (HB 1071), AI-Generated Replicas Amendment to Publicity Rights Act, Arkansas Act 827 of 2025 (HB 1529), Unlawful Creation or Distribution of Deepfake Visual Material, Arkansas Act 977 of 2025 (HB 1877), AI-Generated Child Sexual Abuse Material Amendments, Arkansas Using a Carriage Service to Transmit Sexual Material Without Consent (Deepfake Offences), Australia StGB Section 207a(4)(4), Computer-Generated and Altered Child Sexual Abuse Material, Austria Sexual Offences Act, child pornography offence, Bahamas Cyber Security Act, 2026, AI-generated sexual content and CSAM ban, Bangladesh and 133 more, every one in the free file.
5.2.1-1Full inventory of assets, including their dependencies and connections.	1.1Board Structure & Oversight	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 5.2.1-1 and 1.1 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	1.2Risk Management	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 5.2.1-1 and 1.2 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	3.5Post-deployment Monitoring	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 5.2.1-1 and 3.5 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	4.1System Documentation	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 5.2.1-1 and 4.1 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	4.2Risk Disclosure	15	11	11 in force, 3 not yet in force, 1 proposed
	The 15 laws behind 5.2.1-1 and 4.2 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica and 5 more, every one in the free file.
	4.3Incident Reporting	12	9	9 in force, 2 not yet in force, 1 proposed
	The 12 laws behind 5.2.1-1 and 4.3 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius and 2 more, every one in the free file.
	4.5Third-Party System Access	12	9	9 in force, 2 not yet in force, 1 proposed
	The 12 laws behind 5.2.1-1 and 4.5 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius and 2 more, every one in the free file.
	3.2Data Governance	6	3	4 in force, 2 not yet in force
	The 6 laws behind 5.2.1-1 and 3.2 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Use of artificial intelligence in therapy or psychotherapy services, Maine
	3.3Access Management	4	2	2 in force, 2 not yet in force
	The 4 laws behind 5.2.1-1 and 3.3 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy
	4.4Governance Disclosure	3	3	2 in force, 1 not yet in force
	The 3 laws behind 5.2.1-1 and 4.4 AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius Digital Transformation Act 2025, ICT service permit for AI and AI-related data services, Vanuatu
	4.6User Rights & Recourse	2	2	2 in force
	The 2 laws behind 5.2.1-1 and 4.6 Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
	3.1Testing & Auditing	2	1	2 in force
	The 2 laws behind 5.2.1-1 and 3.1 Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy
5.2.1-4Sensitive data such as training and test sets protected from unauthorised access.	2.1Model & Infrastructure Security	3	2	2 in force, 1 not yet in force
	The 3 laws behind 5.2.1-4 and 2.1 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	2.3Model Safety Engineering	3	2	2 in force, 1 not yet in force
	The 3 laws behind 5.2.1-4 and 2.3 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	3.1Testing & Auditing	3	2	2 in force, 1 not yet in force
	The 3 laws behind 5.2.1-4 and 3.1 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	3.6Incident Response & Recovery	3	2	2 in force, 1 not yet in force
	The 3 laws behind 5.2.1-4 and 3.6 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
5.2.2-5AI-specific incident management and recovery plans that are created, tested and maintained.	4.3Incident Reporting	27	16	19 in force, 7 not yet in force, 1 proposed
	The 27 laws behind 5.2.2-5 and 4.3 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Loi n° 09-04 relative à la prévention et à la lutte contre les infractions liées aux technologies de l'information et de la communication, Algeria Companion Chatbot Safety and Accountability Act (SB 243), California Employment Technological Displacement Notice (SB 951), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months HB 26-1263 (2026), Conversational AI Service Operator Requirements, Colorado AI Act, Article 20 (corrective actions and duty of information), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months and 17 more, every one in the free file.
	4.2Risk Disclosure	26	16	18 in force, 7 not yet in force, 1 proposed
	The 26 laws behind 5.2.2-5 and 4.2 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Loi n° 09-04 relative à la prévention et à la lutte contre les infractions liées aux technologies de l'information et de la communication, Algeria Companion Chatbot Safety and Accountability Act (SB 243), California Employment Technological Displacement Notice (SB 951), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months HB 26-1263 (2026), Conversational AI Service Operator Requirements, Colorado AI Act, Article 20 (corrective actions and duty of information), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months and 16 more, every one in the free file.
	4.5Third-Party System Access	26	16	18 in force, 7 not yet in force, 1 proposed
	The 26 laws behind 5.2.2-5 and 4.5 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Loi n° 09-04 relative à la prévention et à la lutte contre les infractions liées aux technologies de l'information et de la communication, Algeria Companion Chatbot Safety and Accountability Act (SB 243), California Employment Technological Displacement Notice (SB 951), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months HB 26-1263 (2026), Conversational AI Service Operator Requirements, Colorado AI Act, Article 20 (corrective actions and duty of information), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months and 16 more, every one in the free file.
	4.1System Documentation	17	12	11 in force, 5 not yet in force, 1 proposed
	The 17 laws behind 5.2.2-5 and 4.1 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Employment Technological Displacement Notice (SB 951), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary and 7 more, every one in the free file.
	1.1Board Structure & Oversight	12	9	9 in force, 2 not yet in force, 1 proposed
	The 12 laws behind 5.2.2-5 and 1.1 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius and 2 more, every one in the free file.
	1.2Risk Management	12	9	9 in force, 2 not yet in force, 1 proposed
	The 12 laws behind 5.2.2-5 and 1.2 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius and 2 more, every one in the free file.
	3.5Post-deployment Monitoring	12	9	9 in force, 2 not yet in force, 1 proposed
	The 12 laws behind 5.2.2-5 and 3.5 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius and 2 more, every one in the free file.
	4.6User Rights & Recourse	6	4	3 in force, 3 not yet in force
	The 6 laws behind 5.2.2-5 and 4.6 Employment Technological Displacement Notice (SB 951), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Artificial Intelligence Video Interview Act, Illinois Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months
5.2.2-6Contracts with cloud providers that back the requirements above.	3.3Access Management	2	2	1 in force, 1 not yet in force
	The 2 laws behind 5.2.2-6 and 3.3 AI Act, Article 25 (responsibilities along the AI value chain), European Union from 2 Dec 2027, in 13 months Reform to the Federal Labor Law and the Federal Copyright Law, AI Voice and Image Consent Regime for Performing Artists, Mexico
5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans...	1.1Board Structure & Oversight	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 5.2.4-1 and 1.1 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	1.2Risk Management	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 5.2.4-1 and 1.2 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	3.5Post-deployment Monitoring	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 5.2.4-1 and 3.5 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	4.1System Documentation	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 5.2.4-1 and 4.1 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	4.2Risk Disclosure	15	11	11 in force, 3 not yet in force, 1 proposed
	The 15 laws behind 5.2.4-1 and 4.2 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica and 5 more, every one in the free file.
	4.3Incident Reporting	12	9	9 in force, 2 not yet in force, 1 proposed
	The 12 laws behind 5.2.4-1 and 4.3 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius and 2 more, every one in the free file.
	4.5Third-Party System Access	12	9	9 in force, 2 not yet in force, 1 proposed
	The 12 laws behind 5.2.4-1 and 4.5 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius and 2 more, every one in the free file.
	3.2Data Governance	6	3	4 in force, 2 not yet in force
	The 6 laws behind 5.2.4-1 and 3.2 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Use of artificial intelligence in therapy or psychotherapy services, Maine
	3.3Access Management	4	2	2 in force, 2 not yet in force
	The 4 laws behind 5.2.4-1 and 3.3 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy
	4.4Governance Disclosure	3	3	2 in force, 1 not yet in force
	The 3 laws behind 5.2.4-1 and 4.4 AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius Digital Transformation Act 2025, ICT service permit for AI and AI-related data services, Vanuatu
	4.6User Rights & Recourse	2	2	2 in force
	The 2 laws behind 5.2.4-1 and 4.6 Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
	3.1Testing & Auditing	2	1	2 in force
	The 2 laws behind 5.2.4-1 and 3.1 Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy
5.2.4-2.1Minimum record for training data: its source, such as a page URL, and when it was collected.	3.2Data Governance	18	16	17 in force, 1 not yet in force
	The 18 laws behind 5.2.4-2.1 and 3.2 Code de droit économique, article XI.190, 20°, exception de fouille de textes et de données, Belgium Law on Copyright and Related Rights, Content Limitations (No Text-and-Data-Mining Exception), Bosnia and Herzegovina Copyright and Neighbouring Rights Act (ZAPSP), Arts. 26e, 26zh and 26k, Text-and-Data-Mining Exception for Crawling and Training, Bulgaria Copyright (Cayman Islands) Order 2015, text and data analysis exception, Cayman Islands Copyright Act 2013, economic rights, computer program copying, and technological protection measures, Cook Islands Autorský zákon Sections 39c-39d, Text and Data Mining Exception for Automated Analysis, Czech Republic AI Act, Article 53 (obligations for providers of general-purpose AI models), European Union Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union DSM Directive, Article 4 (text-and-data-mining exception and rights reservation), European Union Copyright Act 1999, Fair Dealing and Criminal Liability for Infringement, Fiji from a date not yet set and 8 more, every one in the free file.
	4.1System Documentation	18	16	17 in force, 1 not yet in force
	The 18 laws behind 5.2.4-2.1 and 4.1 Code de droit économique, article XI.190, 20°, exception de fouille de textes et de données, Belgium Law on Copyright and Related Rights, Content Limitations (No Text-and-Data-Mining Exception), Bosnia and Herzegovina Copyright and Neighbouring Rights Act (ZAPSP), Arts. 26e, 26zh and 26k, Text-and-Data-Mining Exception for Crawling and Training, Bulgaria Copyright (Cayman Islands) Order 2015, text and data analysis exception, Cayman Islands Copyright Act 2013, economic rights, computer program copying, and technological protection measures, Cook Islands Autorský zákon Sections 39c-39d, Text and Data Mining Exception for Automated Analysis, Czech Republic AI Act, Article 53 (obligations for providers of general-purpose AI models), European Union Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union DSM Directive, Article 4 (text-and-data-mining exception and rights reservation), European Union Copyright Act 1999, Fair Dealing and Criminal Liability for Infringement, Fiji from a date not yet set and 8 more, every one in the free file.
	2.1Model & Infrastructure Security	2	2	2 in force
	The 2 laws behind 5.2.4-2.1 and 2.1 Copyright Act 2013, economic rights, computer program copying, and technological protection measures, Cook Islands Schutz technischer Massnahmen und Durchsetzung von Schrankenbestimmungen (Protection of Technological Measures), Germany
5.3.1-1Users told where and how their data is used, accessed and stored, with developers...	4.1System Documentation	70	44	42 in force, 16 not yet in force, 12 proposed
	The 70 laws behind 5.3.1-1 and 4.1 Distribution of Materially Deceptive Media to Influence an Upcoming Election, Alabama SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Practice Direction No. 18 of 2025, ethical use of generative AI in court proceedings, Belize Attorney, Court Filing and Arbitrator Generative AI Duties (SB 574), California from 1 Jan 2027, in 2 months California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), California CCPA Automated Decisionmaking Technology Regulations, California Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Companion Chatbot Safety and Accountability Act (SB 243), California and 60 more, every one in the free file.
	4.2Risk Disclosure	70	44	42 in force, 16 not yet in force, 12 proposed
	The 70 laws behind 5.3.1-1 and 4.2 Distribution of Materially Deceptive Media to Influence an Upcoming Election, Alabama SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Practice Direction No. 18 of 2025, ethical use of generative AI in court proceedings, Belize Attorney, Court Filing and Arbitrator Generative AI Duties (SB 574), California from 1 Jan 2027, in 2 months California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), California CCPA Automated Decisionmaking Technology Regulations, California Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Companion Chatbot Safety and Accountability Act (SB 243), California and 60 more, every one in the free file.
	4.6User Rights & Recourse	70	44	42 in force, 16 not yet in force, 12 proposed
	The 70 laws behind 5.3.1-1 and 4.6 Distribution of Materially Deceptive Media to Influence an Upcoming Election, Alabama SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Practice Direction No. 18 of 2025, ethical use of generative AI in court proceedings, Belize Attorney, Court Filing and Arbitrator Generative AI Duties (SB 574), California from 1 Jan 2027, in 2 months California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), California CCPA Automated Decisionmaking Technology Regulations, California Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Companion Chatbot Safety and Accountability Act (SB 243), California and 60 more, every one in the free file.
	2.4Content Safety Controls	23	19	14 in force, 5 not yet in force, 4 proposed
	The 23 laws behind 5.3.1-1 and 2.4 Distribution of Materially Deceptive Media to Influence an Upcoming Election, Alabama California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), California Synthetic Performer Advertising Disclosure Act (SB 1050), California from 1 Jan 2027, in 2 months AI Act, Article 50 (transparency obligations for AI systems and synthetic content), European Union European Commission Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of the AI Act, European Union from a date not yet set Use of Digitally Altered Media in Elections (House Enrolled Act 1133, 2024), Indiana Synthetic Media Disclosure in Electioneering Communications, Kentucky Digital Code, Chapter 23: AI interaction and deepfake disclosure duties, Kyrgyzstan AI-Generated Political Advertisement and Robocall Disclosure (Public Act 263 of 2023), Michigan Conversational Artificial Intelligence Safety Act (LB 525, §§ 12-18), Nebraska from 1 Jul 2027, in 8 months and 13 more, every one in the free file.
	4.3Incident Reporting	6	4	3 in force, 3 not yet in force
	The 6 laws behind 5.3.1-1 and 4.3 Employment Technological Displacement Notice (SB 951), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Artificial Intelligence Video Interview Act, Illinois Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months
	4.5Third-Party System Access	6	4	3 in force, 3 not yet in force
	The 6 laws behind 5.3.1-1 and 4.5 Employment Technological Displacement Notice (SB 951), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Artificial Intelligence Video Interview Act, Illinois Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months
	1.1Board Structure & Oversight	2	2	2 in force
	The 2 laws behind 5.3.1-1 and 1.1 Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
	1.2Risk Management	2	2	2 in force
	The 2 laws behind 5.3.1-1 and 1.2 Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
	3.2Data Governance	2	2	1 in force, 1 not yet in force
	The 2 laws behind 5.3.1-1 and 3.2 Consumer Credit Act, Articles 24 and 30, Personalised Offers and Creditworthiness Assessment by Automated Processing, Croatia from 20 Nov 2026, in 4 weeks Artificial Intelligence Video Interview Act, Illinois
	3.5Post-deployment Monitoring	2	2	2 in force
	The 2 laws behind 5.3.1-1 and 3.5 Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
5.3.1-2.1That guidance covers proper use, limits and likely failure modes.	4.1System Documentation	70	44	42 in force, 16 not yet in force, 12 proposed
	The 70 laws behind 5.3.1-2.1 and 4.1 Distribution of Materially Deceptive Media to Influence an Upcoming Election, Alabama SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Practice Direction No. 18 of 2025, ethical use of generative AI in court proceedings, Belize Attorney, Court Filing and Arbitrator Generative AI Duties (SB 574), California from 1 Jan 2027, in 2 months California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), California CCPA Automated Decisionmaking Technology Regulations, California Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Companion Chatbot Safety and Accountability Act (SB 243), California and 60 more, every one in the free file.
	4.2Risk Disclosure	70	44	42 in force, 16 not yet in force, 12 proposed
	The 70 laws behind 5.3.1-2.1 and 4.2 Distribution of Materially Deceptive Media to Influence an Upcoming Election, Alabama SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Practice Direction No. 18 of 2025, ethical use of generative AI in court proceedings, Belize Attorney, Court Filing and Arbitrator Generative AI Duties (SB 574), California from 1 Jan 2027, in 2 months California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), California CCPA Automated Decisionmaking Technology Regulations, California Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Companion Chatbot Safety and Accountability Act (SB 243), California and 60 more, every one in the free file.
	4.6User Rights & Recourse	70	44	42 in force, 16 not yet in force, 12 proposed
	The 70 laws behind 5.3.1-2.1 and 4.6 Distribution of Materially Deceptive Media to Influence an Upcoming Election, Alabama SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Practice Direction No. 18 of 2025, ethical use of generative AI in court proceedings, Belize Attorney, Court Filing and Arbitrator Generative AI Duties (SB 574), California from 1 Jan 2027, in 2 months California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), California CCPA Automated Decisionmaking Technology Regulations, California Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Companion Chatbot Safety and Accountability Act (SB 243), California and 60 more, every one in the free file.
	2.4Content Safety Controls	23	19	14 in force, 5 not yet in force, 4 proposed
	The 23 laws behind 5.3.1-2.1 and 2.4 Distribution of Materially Deceptive Media to Influence an Upcoming Election, Alabama California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), California Synthetic Performer Advertising Disclosure Act (SB 1050), California from 1 Jan 2027, in 2 months AI Act, Article 50 (transparency obligations for AI systems and synthetic content), European Union European Commission Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of the AI Act, European Union from a date not yet set Use of Digitally Altered Media in Elections (House Enrolled Act 1133, 2024), Indiana Synthetic Media Disclosure in Electioneering Communications, Kentucky Digital Code, Chapter 23: AI interaction and deepfake disclosure duties, Kyrgyzstan AI-Generated Political Advertisement and Robocall Disclosure (Public Act 263 of 2023), Michigan Conversational Artificial Intelligence Safety Act (LB 525, §§ 12-18), Nebraska from 1 Jul 2027, in 8 months and 13 more, every one in the free file.
	4.3Incident Reporting	6	4	3 in force, 3 not yet in force
	The 6 laws behind 5.3.1-2.1 and 4.3 Employment Technological Displacement Notice (SB 951), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Artificial Intelligence Video Interview Act, Illinois Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months
	4.5Third-Party System Access	6	4	3 in force, 3 not yet in force
	The 6 laws behind 5.3.1-2.1 and 4.5 Employment Technological Displacement Notice (SB 951), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Artificial Intelligence Video Interview Act, Illinois Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months
	1.1Board Structure & Oversight	2	2	2 in force
	The 2 laws behind 5.3.1-2.1 and 1.1 Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
	1.2Risk Management	2	2	2 in force
	The 2 laws behind 5.3.1-2.1 and 1.2 Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
	3.2Data Governance	2	2	1 in force, 1 not yet in force
	The 2 laws behind 5.3.1-2.1 and 3.2 Consumer Credit Act, Articles 24 and 30, Personalised Offers and Creditworthiness Assessment by Automated Processing, Croatia from 20 Nov 2026, in 4 weeks Artificial Intelligence Video Interview Act, Illinois
	3.5Post-deployment Monitoring	2	2	2 in force
	The 2 laws behind 5.3.1-2.1 and 3.5 Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
5.4.2-1Operators log system and user actions.	1.1Board Structure & Oversight	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 5.4.2-1 and 1.1 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	1.2Risk Management	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 5.4.2-1 and 1.2 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	3.5Post-deployment Monitoring	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 5.4.2-1 and 3.5 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	4.1System Documentation	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 5.4.2-1 and 4.1 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	4.2Risk Disclosure	15	11	11 in force, 3 not yet in force, 1 proposed
	The 15 laws behind 5.4.2-1 and 4.2 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica and 5 more, every one in the free file.
	4.3Incident Reporting	12	9	9 in force, 2 not yet in force, 1 proposed
	The 12 laws behind 5.4.2-1 and 4.3 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius and 2 more, every one in the free file.
	4.5Third-Party System Access	12	9	9 in force, 2 not yet in force, 1 proposed
	The 12 laws behind 5.4.2-1 and 4.5 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius and 2 more, every one in the free file.
	3.2Data Governance	6	3	4 in force, 2 not yet in force
	The 6 laws behind 5.4.2-1 and 3.2 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Use of artificial intelligence in therapy or psychotherapy services, Maine
	3.3Access Management	4	2	2 in force, 2 not yet in force
	The 4 laws behind 5.4.2-1 and 3.3 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy
	4.4Governance Disclosure	3	3	2 in force, 1 not yet in force
	The 3 laws behind 5.4.2-1 and 4.4 AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius Digital Transformation Act 2025, ICT service permit for AI and AI-related data services, Vanuatu
	4.6User Rights & Recourse	2	2	2 in force
	The 2 laws behind 5.4.2-1 and 4.6 Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
	3.1Testing & Auditing	2	1	2 in force
	The 2 laws behind 5.4.2-1 and 3.1 Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy
5.4.2-2Logs analysed for anomalies, breaches and effects of drift or poisoning.	2.1Model & Infrastructure Security	3	2	2 in force, 1 not yet in force
	The 3 laws behind 5.4.2-2 and 2.1 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	2.3Model Safety Engineering	3	2	2 in force, 1 not yet in force
	The 3 laws behind 5.4.2-2 and 2.3 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	3.1Testing & Auditing	3	2	2 in force, 1 not yet in force
	The 3 laws behind 5.4.2-2 and 3.1 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	3.6Incident Response & Recovery	3	2	2 in force, 1 not yet in force
	The 3 laws behind 5.4.2-2 and 3.6 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy

Not connected to the MIT mitigations: 53 of ETSI EN 304 223's provisions

Short of 2 laws

The same duties reach these and a MIT mitigations control, in fewer than 2 of the laws we track.

5.3.1-3 Support for users and affected parties during and after a security incident, set out...: with 3.6 and 4.3 through Law on Artificial Intelligence, incident management and reporting obligation, Vietnam

No law we track reaches these

No duty in the laws we track reaches these provisions.

5.1.1-1 AI security content in the regular staff training programme, kept current.
5.1.1-1.1 That training is adjusted to each person's role.
5.1.1-2 All staff kept aware of current AI-related threats and the mitigations that exist.
5.1.1-2.1 Threat updates circulated through several internal channels.
5.1.1-2.2 Developers trained in secure coding and system design for AI work.
5.1.2-1.1 Data custodians inside the developer's own organisation join the requirements discussion.
5.1.2-3 Audit trail covering models, datasets and prompts through their lifecycle.
5.1.2-4 Security risk assessment and due diligence before using an external component.
5.1.2-5 Data custodians check that the intended use suits how sensitive the training data is.
5.1.2-5.1 Staff encouraged to raise AI security concerns, with safeguards in place for doing so.
5.1.3-1.1 Threat modelling repeated whenever a setting or configuration option is added or changed.
5.1.3-1.2 Developers manage the risk from model capabilities the system does not need.
5.1.3-1.3 Operators apply controls to the risks found, weighed against cost and their risk tolerance.
5.1.3-3 Operators seek assurance from outside parties who hold responsibility for identified risks.
5.1.3-4 Continuous monitoring and review of infrastructure against the organisation's risk appetite.
5.1.4-2 Systems designed so people can judge the outputs they answer for.
5.1.4-4 Developers verify that the data custodian's security controls made it into the build.
5.2.1-2 Tooling and processes to track, authenticate, version and secure AI assets.
5.2.1-3 Disaster recovery plans adapted to attacks aimed at AI systems.
5.2.1-3.1 A known good state can be restored.
5.2.1-4.1 Checks and sanitisation applied to data and inputs, and repeated when the model is revised.
5.2.1-4.2 Proportionate protection where training data or model weights may be confidential.
5.2.2-1 Access-control review, and measures to secure APIs, models, data and pipelines.
5.2.2-2 Controls, such as rate limits, on any API offered to outside parties.
5.2.2-3 Separate environments for development and tuning, with least privilege enforced technically.
5.2.2-4 A published, easy-to-find vulnerability disclosure policy.
5.2.3-1 Secure software supply-chain practice for developing models and systems.
5.2.3-2 Written justification when using models or components that are poorly documented or secured.
5.2.3-2.1 Mitigating controls and a risk assessment for those components.
5.2.3-2.2 That justification shared with end-users in an accessible way.
5.2.3-3 Evaluations run again on released models before they are adopted.
5.2.3-4 End-users told before a model is updated.
5.2.4-1.1 That documentation records security-relevant facts such as data sources, scope,...
5.2.4-1.2 Cryptographic hashes published for model components handed to others.
5.2.4-2 Records of how publicly sourced training data was obtained, where it came from and how...
5.2.4-3 Audit log of changes to system prompts and other configuration that alter behaviour.
5.2.5-1 Every model, application and system is security-assessed before release.
5.2.5-2 Operators test before deployment, with developer support.
5.2.5-2.1 Independent testers with relevant AI skills used for security testing.
5.2.5-3 Developers pass their test findings to operators.
5.2.5-4 Outputs evaluated so that non-public details of the model or its training data cannot...
5.2.5-4.1 Outputs evaluated so users cannot gain unintended influence over the system.
5.3.1-2 Accessible guidance on using, managing, integrating and configuring the system.
5.3.1-2.2 Users proactively told about security-relevant updates.
5.4.1-1 Developers issue security patches and notify operators, who pass them to users.
5.4.1-1.1 Contingency mechanisms for cases where an update cannot be issued.
5.4.1-2 A major update is treated as a new model version and re-tested.
5.4.1-3 Operators helped to evaluate model changes, for example with preview access and versioned APIs.
5.4.2-3 Internal system states monitored where that helps address security threats.
5.4.2-4 Model and system performance tracked over time for shifts in behaviour that touch security.
5.5.1-1 Data custodians involved and assets securely disposed of when training data or a model...
5.5.1-2 Data custodians involved and data and configuration securely deleted when a model or...

How these connections are drawn

Each requirement line in the laws we track is read against the framework for its subject (the AI, scraping and news aggregation laws against the NIST AI RMF, the privacy, communications and age assurance laws against the NIST Privacy Framework, the cybersecurity laws against the NIST CSF 2.0); laws on liability and content moderation are not read against any framework yet. A line reaches either framework through a kind of duty its law carries, and only where that kind of duty also reaches, on that same line, the NIST framework for the line's own subject. Two provisions connect when lines in at least 2 laws reach both. That says the same duties reach both; it does not say the two are alike, or that running either one does what a law asks.

Every duty line in the AI, scraping and news aggregation laws we track has been read against the framework for its subject.

Sources and licenses

Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.

MIT AI Risk Initiative (MIT FutureTech), AI Risk Mitigation Taxonomy. Data from the MIT AI Risk Initiative is licensed under CC BY 4.0. Cite as: Mapping AI Risk Mitigations: Evidence Scan & Draft Mitigation Taxonomy