Law / Frameworks / FINOS AIGF
FINOS AI Governance Framework
Below are its 25 controls in the framework's own order, and under each one the laws we track that bear on it. Each mapping is our reading that a law bears on a control, never a finding that running the control meets the law.
This framework is read at more length, with what it cites, the legal responsibilities a financial institution carries out through software and the financial law the law library adds, on the FINOS page.
Where the law lands in the framework
16of 25 controls have law1,174laws231places
Of these laws, 1,038 are in force, 101 not yet in force, 1 blocked by a court, and 34 proposed and not law.
6 of the 17 controls under Preventative have no law we track under them.
- in force
- not yet in force
- blocked by a court
- proposed
- no law we track
Read through the kinds of duty each AI, scraping, news aggregation, privacy, communications, age assurance and cybersecurity law we track carries, counting a kind of duty only where the law's own requirement lines, as read against the NIST framework for its subject (the NIST AI Risk Management Framework, the NIST Privacy Framework or the NIST Cybersecurity Framework), bear it out.
Preventative
11 of 17 controls with law| Control | What it says | Laws, by state | Laws | Places | Not yet in force | Blocked | Proposed |
|---|---|---|---|---|---|---|---|
| AIR-PREV-002 | Data Filtering From External Knowledge Bases no law we track | no law we track | |||||
| AIR-PREV-003 | User/App/Model Firewalling/Filtering no law we track | no law we track | |||||
| AIR-PREV-005 | System Acceptance Testing 512 laws, 47 not yet in force, 1 blocked, 14 proposed | 512 | 191 | 47 | 1 | 14 | |
| AIR-PREV-006 | Data Quality & Classification/Sensitivity 396 laws, 53 not yet in force, 14 proposed | 396 | 147 | 53 | 0 | 14 | |
| AIR-PREV-007 | Legal and Contractual Frameworks for AI Systems 283 laws, 25 not yet in force, 7 proposed | 283 | 146 | 25 | 0 | 7 | |
| AIR-PREV-008 | Quality of Service (QoS) and DDoS Prevention for AI Systems 154 laws, 14 not yet in force, 4 proposed | 154 | 116 | 14 | 0 | 4 | |
| AIR-PREV-010 | AI Model Version Pinning no law we track | no law we track | |||||
| AIR-PREV-012 | Role-Based Access Control for AI Data 154 laws, 14 not yet in force, 4 proposed | 154 | 116 | 14 | 0 | 4 | |
| AIR-PREV-014 | Encryption of AI Data at Rest 154 laws, 14 not yet in force, 4 proposed | 154 | 116 | 14 | 0 | 4 | |
| AIR-PREV-017 | AI Firewall Implementation and Management 154 laws, 14 not yet in force, 4 proposed | 154 | 116 | 14 | 0 | 4 | |
| AIR-PREV-018 | Agent Authority Least Privilege Framework 134 laws, 3 not yet in force | 134 | 103 | 3 | 0 | 0 | |
| AIR-PREV-019 | Tool Chain Validation and Sanitization no law we track | no law we track | |||||
| AIR-PREV-020 | MCP Server Security Governance 154 laws, 14 not yet in force, 4 proposed | 154 | 116 | 14 | 0 | 4 | |
| AIR-PREV-022 | Multi-Agent Isolation and Segmentation no law we track | no law we track | |||||
| AIR-PREV-023 | Agentic System Credential Protection Framework 134 laws, 3 not yet in force | 134 | 103 | 3 | 0 | 0 | |
| AIR-PREV-024 | Human-in-the-Loop Action Approval Gate 223 laws, 35 not yet in force, 6 proposed | 223 | 132 | 35 | 0 | 6 | |
| AIR-PREV-025 | Skill/Plugin Integrity and Governance no law we track | no law we track | |||||
Detective
5 of 8 controls with law| Control | What it says | Laws, by state | Laws | Places | Not yet in force | Blocked | Proposed |
|---|---|---|---|---|---|---|---|
| AIR-DET-001 | AI Data Leakage Prevention and Detection 229 laws, 25 not yet in force, 8 proposed | 229 | 132 | 25 | 0 | 8 | |
| AIR-DET-004 | AI System Observability 421 laws, 53 not yet in force, 10 proposed | 421 | 171 | 53 | 0 | 10 | |
| AIR-DET-009 | AI System Alerting and Denial of Wallet (DoW) / Spend Monitoring no law we track | no law we track | |||||
| AIR-DET-011 | Human Feedback Loop for AI Systems 223 laws, 35 not yet in force, 6 proposed | 223 | 132 | 35 | 0 | 6 | |
| AIR-DET-013 | Providing Citations and Source Traceability for AI-Generated Information 32 laws | 32 | 26 | 0 | 0 | 0 | |
| AIR-DET-015 | Using Large Language Models for Automated Evaluation (LLM-as-a-Judge) no law we track | no law we track | |||||
| AIR-DET-016 | Preserving Source Data Access Controls in AI Systems no law we track | no law we track | |||||
| AIR-DET-021 | Agent Decision Audit and Explainability 586 laws, 63 not yet in force, 24 proposed | 586 | 187 | 63 | 0 | 24 | |
Where the law and the framework part
9 of the 25 controls have no law we track under them.
Kinds of duty this framework has no control for: age verification, consent, content labelling, design code, licensing.
The framework's text
Full text of the FINOS AI Governance Framework, CC BY 4.0. FINOS AI Governance Framework, https://air-governance-framework.finos.org/, copyright 2025 FINOS, licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Titles and purpose text are quoted; markdown emphasis and links were removed.
Read it from the publisher: air-governance-framework.finos.org