Law / Frameworks / FINOS AIGF / Detective

FINOS AIGF AIR-DET-001AI Data Leakage Prevention and Detection

Data Leakage Prevention and Detection (DLP&D) for Artificial Intelligence (AI) systems encompasses a combination of proactive measures to prevent sensitive data from unauthorized egress or exposure through these systems, and detective measures to identify such incidents promptly if they occur. This control is critical for safeguarding various types of information associated with AI, including: Session Data; Training Data; Model Intellectual Property.FINOS AI Governance Framework, version 2, as maintained on October 7, 2026, AIR-DET-001

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of 8 Oct 2026.

The kinds of duty that reach it: breach notice, security.

229: laws
132: places
0: with court rulings behind them
25: not yet in force
8: proposed, not law

The same ground elsewhere linked through the kinds of duty both controls are mapped from

NIST AI RMFGOVERN 4.3 Organizational practices are in place to enable AI testing, identification of...
NIST AI RMFMEASURE 2.5 The AI system to be deployed is demonstrated to be valid and reliable. Limitations of...
NIST AI 600-1GAI-RISK-04 Data Privacy
NIST AI 600-1GAI-RISK-09 Information Security
OWASP LLM Top 10LLM01:2026 Prompt Injection
OWASP LLM Top 10LLM02:2026 Sensitive Information Disclosure
OWASP Agentic Top 10ASI01 Agent Goal Hijack
OWASP Agentic Top 10ASI03 Identity and Privilege Abuse
MIT mitigations3.6 Incident Response & Recovery
MIT mitigations2.1 Model & Infrastructure Security
NIST Privacy FrameworkPR.PO-P7 Response plans (Incident Response and Business Continuity) and recovery plans...
NIST Privacy FrameworkCM.AW-P7 Impacted individuals and organizations are notified about a privacy breach or event.
NIST CSF 2.0ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are...
NIST CSF 2.0GV.SC-08 Relevant suppliers and other third parties are included in incident planning,...
CIS Controls3.10 Encryption of sensitive data as it crosses networks.
CIS Controls3.11 Encryption of sensitive data where it is stored on servers and applications.

A law in force is unmarked; the rest wear their state: not yet in force proposed

Comprehensive regime

81 laws, 79 places

Place	Law	How it reaches this control
Albania	Law No. 124/2024 On the Protection of Personal Data	Through its security duty. What it requires
Algeria	Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11	Through its security duty. What it requires
Andorra	LQPD, Llei 29/2021 del 28 d'octubre	Through its security duty. What it requires
Angola	Law on the Protection of Personal Data	Through its security duty. What it requires
Antigua and Barbuda	Data Protection Act, 2013	Through its security duty. What it requires
Argentina	Ley 25.326, Ley de Protección de los Datos Personales	Through its security duty. What it requires
Barbados	Data Protection Act, 2019	Through its security duty. What it requires
Belarus	Law of the Republic of Belarus On Personal Data Protection	Through its security duty. What it requires
Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel)	Through its security duty. What it requires
Bolivia	Ley General de Telecomunicaciones, Inviolabilidad y Secreto de las Comunicaciones y Protección de Datos Personales	Through its security duty. What it requires

Show the other 71 laws

Bolivia	Reglamento para el Desarrollo de TIC, Tratamiento de los Datos Personales	Through its security duty. What it requires
Bosnia and Herzegovina	Law on the Protection of Personal Data of Bosnia and Herzegovina	Through its security duty. What it requires
Botswana	Data Protection Act, 2024 (Act No. 18 of 2024)	Through its security duty. What it requires
Brazil	Lei Geral de Proteção de Dados Pessoais (LGPD)	Through its security duty. What it requires
Burkina Faso	Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel	Through its security duty. What it requires
Cabo Verde	Law No. 133/V/2001 on the Protection of Personal Data	Through its security duty. What it requires
Cambodia	Draft Law on Personal Data Protection, final draft proposed	Through its security duty. What it requires
Cameroon	Loi n°2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun from a date not yet set	Through its breach notice duty. What it requires
Central African Republic	Loi n° 24.001 portant protection des données à caractère personnel	Through its security duty. What it requires
Colombia	Ley 1581 de 2012, General Personal Data Protection	Through its security duty. What it requires
Colombia	Superintendencia Circular on AI and Personal Data	Through its security duty. What it requires
Comoros	Law on the Protection of Personal Data	Through its security duty. What it requires
Costa Rica	Protección de la Persona frente al Tratamiento de sus Datos Personales	Through its security duty. What it requires
Cuba	Ley 149/2022, De Protección de Datos Personales, general regime	Through its breach notice duty. What it requires
Democratic Republic of the Congo	Digital Code, Title III: Personal Data Protection	Through its security duty. What it requires
Djibouti	Digital Code, Book I: Personal Data Protection and CNDP	Through its security duty. What it requires
Dominican Republic	Ley No. 172-13 sobre Protección Integral de los Datos Personales	Through its security duty. What it requires
Ecuador	LOPDP, comprehensive personal-data protection regime	Through its security duty. What it requires
Egypt	Law No. 151 of 2020 Promulgating the Personal Data Protection Law	Through its security duty. What it requires
El Salvador	Ley para la Protección de Datos Personales	Through its security duty. What it requires
Equatorial Guinea	Ley de Protección de Datos Personales	Through its security duty. What it requires
Eswatini	Data Protection Act, 2022 (Act No. 5 of 2022)	Through its security duty. What it requires
Ethiopia	Personal Data Protection Proclamation	Through its security duty. What it requires
Gabon	Loi n°001/2011 relative à la protection des données à caractère personnel, modifiée par la loi n°025/2023	Through its security duty. What it requires
Ghana	Data Protection Act	Through its security duty. What it requires
Grenada	Data Protection Act, No. 1 of 2023 from a date not yet set	Through its security duty. What it requires
Jamaica	Data Protection Act, 2020, registration, lawful basis and standards for processing	Through its security duty. What it requires
Kiribati	Data Protection Act 2025 from a date not yet set	Through its security duty. What it requires
Kosovo	Law No. 06/L-082 on Protection of Personal Data	Through its security duty. What it requires
Lebanon	Law No. 81/2018 on Electronic Transactions and Personal Data, Part V (Personal Data Protection)	Through its security duty. What it requires
Lesotho	Data Protection Act, 2011 (Act No. 5 of 2012)	Through its security duty. What it requires
Liberia	Telecommunications Act of 2007, Protection of Personal Information (§§ 51-52)	Through its security duty. What it requires
Madagascar	Law No. 2014-038, protection of personal data	Through its security duty. What it requires
Malawi	Electronic Transactions and Cyber Security Act, 2016, personal data processing and security duties (Part VII)	Through its security duty. What it requires
Maldives	Personal Data Protection Bill, pending before the People's Majlis proposed	Through its security duty. What it requires
Mali	Loi n° 2013-015, protection des données à caractère personnel	Through its security duty. What it requires
Marshall Islands	Personal Data Protection Act 2025, government personal-data protection principles	Through its security duty. What it requires
Mexico	Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP)	Through its security duty. What it requires
Moldova	Law No. 195/2024 on Personal Data Protection	Through its security duty. What it requires
Monaco	Loi sur la Protection des Données Personnelles	Through its security duty. What it requires
Montenegro	Law on Personal Data Protection from a date not yet set	Through its security duty. What it requires
Morocco	Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data	Through its security duty. What it requires
Mozambique	Electronic Transactions Law, Protection of Personal Electronic Data	Through its security duty. What it requires
Nauru	Communications and Broadcasting Act 2018, confidentiality of subscriber information and communications	Through its security duty. What it requires
Nicaragua	Ley No. 787, Ley de Protección de Datos Personales	Through its security duty. What it requires
Niger	Loi n° 2022-59, protection des données à caractère personnel	Through its security duty. What it requires
Panama	Ley 81 de 2019, Sobre Protección de Datos Personales	Through its security duty. What it requires
Paraguay	Ley N° 7593/2025, de Protección de Datos Personales en la República del Paraguay from 27 Nov 2027, in 14 months	Through its security duty. What it requires
Peru	Ley 29733, Ley de Protección de Datos Personales	Through its security duty. What it requires
Republic of the Congo	Law No. 29-2019 on the Protection of Personal Data	Through its security duty. What it requires
Rwanda	Law relating to the Protection of Personal Data and Privacy	Through its security duty. What it requires
Saint Kitts and Nevis	Data Protection Act, 2018 from a date not yet set	Through its security duty. What it requires
Saint Lucia	Data Protection Act	Through its security duty. What it requires
Samoa	Telecommunications Act 2005, confidentiality and protection of customer personal information	Through its security duty. What it requires
San Marino	San Marino Law No. 171 on the Protection of Natural Persons	Through its security duty. What it requires
Sao Tome and Principe	Lei n.º 03/2016, Protecção de Dados Pessoais	Through its security duty. What it requires
Senegal	Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel (Personal Data Protection Act)	Through its security duty. What it requires
Solomon Islands	Telecommunications Act 2009, Confidentiality and Consent Duties	Through its security duty. What it requires
Somalia	Data Protection Act No. 005 of 2023	Through its security duty. What it requires
South Africa	Protection of Personal Information Act 4 of 2013 (POPIA)	Through its security duty. What it requires
Suriname	Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens) proposed	Through its security duty. What it requires
Syria	Law No. 12 of 2024 on Protection of Electronic Personal Data	Through its security duty. What it requires
Taiwan	Personal Data Protection Act (個人資料保護法)	Through its breach notice duty. What it requires
Togo	Loi n° 2019-014, protection des données à caractère personnel	Through its security duty. What it requires
Tonga	Privacy Act 2025, comprehensive personal information protection regime from a date not yet set	Through its security duty. What it requires
Uganda	Data Protection and Privacy Act, 2019, comprehensive personal-data regime	Through its security duty. What it requires
Uruguay	Ley N° 18.331, Personal Data Protection and Habeas Data Law, as amended	Through its security duty. What it requires
Vanuatu	Data Protection and Privacy Act 2024, comprehensive personal data protection regime	Through its security duty. What it requires
Vatican City	General Regulation on the Protection of Personal Data for Vatican City State	Through its security duty. What it requires
Zambia	Data Protection Act, 2021, personal data processing framework	Through its security duty. What it requires
Zimbabwe	Cyber and Data Protection Act [Chapter 12:07]	Through its security duty. What it requires

Breach notification

71 laws, 70 places

Place	Law	How it reaches this control
Albania	Law No. 124/2024, notification of a personal data breach	Through its breach notice duty. What it requires
Algeria	Loi n° 18-07 relative à la protection des personnes physiques, notification des violations de données	Through its breach notice duty. What it requires
Andorra	LQPD, personal data breach notification	Through its breach notice duty. What it requires
Barbados	Data Protection Act, 2019, personal data breach notification	Through its breach notice duty. What it requires
Belarus	Law of the Republic of Belarus On Personal Data Protection, notification of personal data protection violations	Through its breach notice duty. What it requires
Belize	Data Protection Act 2021, personal data breach notification from a date not yet set	Through its breach notice duty. What it requires
Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, notification des ruptures de sécurité	Through its breach notice duty. What it requires
Bosnia and Herzegovina	Law on the Protection of Personal Data of Bosnia and Herzegovina, personal data breach notification	Through its breach notice duty. What it requires
Botswana	Data Protection Act, 2024, personal data breach notification	Through its breach notice duty. What it requires
Brazil	LGPD, security incident notification	Through its breach notice duty. What it requires

Show the other 61 laws

California	California Data Breach Notification Law, as amended by SB 446	Through its breach notice duty. What it requires
Cambodia	Cambodia's Draft Law on Personal Data Protection, personal data breach notification proposed	Through its breach notice duty. What it requires
Cayman Islands	Data Protection Act 2021 Revision, personal data breach notification	Through its breach notice duty. What it requires
Chad	Loi n°007/PR/2015, obligation de notification des violations de données à l'ANSICE	Through its breach notice duty. What it requires
Colombia	Ley 1581 de 2012, Security Breach Notification to the Authority	Through its breach notice duty. What it requires
Connecticut	Breach of security re computerized data containing personal information from a date not yet set	Through its breach notice duty. What it requires
Democratic Republic of the Congo	Digital Code, Title III, personal data breach notification	Through its breach notice duty. What it requires
District of Columbia	Consumer Security Breach Notification	Through its breach notice duty. What it requires
Djibouti	Digital Code, Book I: personal-data breach notification	Through its breach notice duty. What it requires
Ecuador	LOPDP, notificación de vulneración de seguridad	Through its breach notice duty. What it requires
Egypt	Egypt Personal Data Protection Law, Personal Data Infringement notification	Through its breach notice duty. What it requires
El Salvador	Ley para la Protección de Datos Personales, personal data breach notification	Through its breach notice duty. What it requires
Eswatini	Data Protection Act, 2022, notification of security compromises	Through its breach notice duty. What it requires
Ethiopia	Personal Data Protection Proclamation, personal data breach notification	Through its breach notice duty. What it requires
European Union	GDPR Articles 33-34, Breach Notification	Through its breach notice duty. What it requires
Gabon	Law No. 025/2023, personal-data breach notification	Through its breach notice duty. What it requires
Gambia	Personal Data Protection and Privacy Act, 2025, personal data breach notification from a date not yet set	Through its breach notice duty. What it requires
Ghana	Data Protection Act, notification of security compromises	Through its breach notice duty. What it requires
Guam	Notification of Breaches of Personal Information	Through its breach notice duty. What it requires
Illinois	Personal Information Protection Act, data breach notification	Through its breach notice duty. What it requires
Ireland	GDPR Articles 33-34, Breach Notification in Ireland	Through its breach notice duty. What it requires
Jamaica	Data Protection Act, 2020, reporting a contravention or security breach	Through its breach notice duty. What it requires
Kiribati	Data Protection Act 2025, personal data breaches from a date not yet set	Through its breach notice duty. What it requires
Kosovo	Law No. 06/L-082 on Protection of Personal Data, personal data breach notification	Through its breach notice duty. What it requires
Lesotho	Data Protection Act, 2011, notification of security compromises	Through its breach notice duty. What it requires
Maldives	Maldives Personal Data Protection Bill, personal data breach notification proposed	Through its breach notice duty. What it requires
Maryland	Maryland Personal Information Protection Act (MPIPA), breach notification from a date not yet set	Through its breach notice duty. What it requires
Mexico	Ley Federal de Protección de Datos Personales en Posesión de los Particulares, security-breach notice	Through its breach notice duty. What it requires
Moldova	Moldova Law No. 195/2024, personal data breach notification	Through its breach notice duty. What it requires
Monaco	Loi sur la Protection des Données Personnelles, notification des violations de données	Through its breach notice duty. What it requires
Nevada	Security breach of personal information, notification from a date not yet set	Through its breach notice duty. What it requires
New Hampshire	Notice of Security Breach	Through its breach notice duty. What it requires
Nicaragua	Ley No. 787, Ley de Protección de Datos Personales, security incident notice	Through its breach notice duty. What it requires
Niger	Loi n° 2022-59, notification des violations de données	Through its breach notice duty. What it requires
Nigeria	Nigeria Data Protection Act, 2023, data breach notification	Through its breach notice duty. What it requires
North Carolina	Identity Theft Protection Act, security breach notification from a date not yet set	Through its breach notice duty. What it requires
North Macedonia	Law on Personal Data Protection (LPDP), personal data breach notification	Through its breach notice duty. What it requires
Panama	Ley 81 de 2019, personal data breach notification	Through its breach notice duty. What it requires
Paraguay	Ley N° 7593/2025, notificación de un incidente de seguridad from 27 Nov 2027, in 14 months	Through its breach notice duty. What it requires
Puerto Rico	Ley de Información al Ciudadano sobre la Seguridad de Bancos de Información (data breach notification)	Through its breach notice duty. What it requires
Republic of the Congo	Law No. 29-2019, personal-data breach notification	Through its breach notice duty. What it requires
Rwanda	Law relating to the Protection of Personal Data and Privacy, personal data breach notification	Through its breach notice duty. What it requires
Samoa	National Digital Identification Act 2024, personal data breach notification	Through its breach notice, security duties. What it requires
San Marino	San Marino Law No. 171, personal data breach notification	Through its breach notice duty. What it requires
Serbia	Law on Personal Data Protection, personal data breach notification	Through its breach notice duty. What it requires
Somalia	Data Protection Act, 2023, personal data breach notification	Through its breach notice duty. What it requires
South Africa	Protection of Personal Information Act, notification of security compromises	Through its breach notice duty. What it requires
South Carolina	Business data breach of security, notification statute	Through its breach notice duty. What it requires
Suriname	Draft Law on the Protection of Privacy and Personal Data, breach notification proposed	Through its breach notice duty. What it requires
Syria	Law No. 12 of 2024 on Protection of Electronic Personal Data, personal data breach notification	Through its breach notice duty. What it requires
Tonga	Privacy Act 2025, personal information breaches from a date not yet set	Through its breach notice duty. What it requires
Uganda	Data Protection and Privacy Act, 2019, breach notification	Through its breach notice duty. What it requires
Ukraine	Draft Law No. 8153, personal data breach notification proposed	Through its breach notice duty. What it requires
United Kingdom	UK GDPR Articles 33-34 and PECR, Breach Notification in the United Kingdom	Through its breach notice duty. What it requires
United States	HIPAA Breach Notification Rule	Through its breach notice duty. What it requires
Uruguay	Ley N° 19.670, personal data breach notification	Through its breach notice duty. What it requires
Virginia	Breach of personal information notification from a date not yet set	Through its breach notice duty. What it requires
Washington	Notice of security breaches involving personal information	Through its breach notice duty. What it requires
Zambia	Data Protection Act, 2021, notification of a security breach	Through its breach notice duty. What it requires
Zimbabwe	Cyber and Data Protection Act, security breach notification	Through its breach notice duty. What it requires
Zimbabwe	Cyber and Data Protection Regulations 2024, security breach notification	Through its breach notice duty. What it requires

Security baseline statutes

33 laws, 31 places

Place	Law	How it reaches this control
Alabama	Data Breach Notification Act, reasonable security measures and disposal of records	Through its security duty. What it requires
Arkansas	Arkansas Personal Information Protection Act, reasonable security procedures	Through its security duty. What it requires
Belarus	Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40)	Through its security duty. What it requires
California	Customer Records Act, Reasonable Security Procedures	Through its security duty. What it requires
China	Data Security Law, Data Security Protection Obligations	Through its security duty. What it requires
Colorado	Protection of personal identifying information, reasonable security procedures duty	Through its security duty. What it requires
Connecticut	Connected device provider's duty to protect recorded personal information with reasonable security measures	Through its security duty. What it requires
Connecticut	Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty	Through its security duty. What it requires
Cuba	Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty	Through its security duty. What it requires
Delaware	Computer Security Breaches, protection of personal information	Through its security duty. What it requires

Show the other 23 laws

Democratic Republic of the Congo	Digital Code, Livre IV: Digital Services Provider Security Obligations	Through its security duty. What it requires
District of Columbia	Security requirements for personal information (Security Breach Protection Amendment Act of 2020)	Through its security duty. What it requires
Florida	Florida Information Protection Act, data security and disposal duty	Through its security duty. What it requires
Illinois	Personal Information Protection Act, data security duty	Through its security duty. What it requires
Indiana	Disclosure of Security Breach Act, data base owner's duty to maintain reasonable security procedures and dispose of records from a date not yet set	Through its security duty. What it requires
Kansas	Kansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information	Through its security duty. What it requires
Kazakhstan	Digital Code, general cybersecurity duty on digital-object owners and holders	Through its security duty. What it requires
Kuwait	Data Classification Policy	Through its security duty. What it requires
Louisiana	Database Security Breach Notification Law, reasonable security procedures and destruction duty	Through its security duty. What it requires
Maryland	Maryland Personal Information Protection Act (MPIPA), safeguards and secure-disposal duty	Through its security duty. What it requires
Massachusetts	Standards for the Protection of Personal Information of Residents of the Commonwealth	Through its security duty. What it requires
Mexico	Ley Federal de Protección al Consumidor, Electronic Transaction Security Duty (Arts. 76 Bis, 76 Bis 1)	Through its security duty. What it requires
Montenegro	Law on Information Security, General Security Measures	Through its security duty. What it requires
Nebraska	Financial Data Protection and Consumer Notification of Data Security Breach Act, security procedures and practices duty	Through its security duty. What it requires
Nevada	Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield from a date not yet set	Through its security duty. What it requires
Nevada	Security measures for data collectors maintaining personal information from a date not yet set	Through its security duty. What it requires
New Mexico	Data Breach Notification Act, security and disposal duties from a date not yet set	Through its security duty. What it requires
Oregon	Oregon Consumer Information Protection Act, requirement to develop safeguards for personal information	Through its security duty. What it requires
Rhode Island	Identity Theft Protection Act of 2015, risk-based information security program from a date not yet set	Through its security duty. What it requires
Texas	Identity Theft Enforcement and Protection Act, business duty to protect sensitive personal information	Through its security duty. What it requires
Turkmenistan	Law on Information and Its Protection, information-security duty	Through its security duty. What it requires
Utah	Protection of Personal Information Act, reasonable procedures and records-destruction duty	Through its security duty. What it requires
Vietnam	Cybersecurity Law, Information System Classification and Protection Measures	Through its security duty. What it requires

Sector security regimes

16 laws, 16 places

Place	Law	How it reaches this control
Angola	Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases	Through its security duty. What it requires
Burundi	Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers	Through its security duty. What it requires
Democratic Republic of the Congo	Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty	Through its security duty. What it requires
Djibouti	Digital Code, Book VI: Critical Installation Protection and Operator Security Controls	Through its security duty. What it requires
Ethiopia	Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations from 21 Jul 2027, in 9 months	Through its security duty. What it requires
Haiti	BRH Circulaire 126, Information Security Rules for Financial Institutions	Through its security duty. What it requires
Iceland	Minimum Risk-Management and Preparedness Requirements for Critical Infrastructure	Through its security duty. What it requires
Latvia	Nacionālās kiberdrošības likums, Cybersecurity Risk-Management Measures	Through its security duty. What it requires
Lebanon	Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts)	Through its security duty. What it requires
Liberia	Telecommunications Act 2007, Security Safeguards for Customer Information and Communications	Through its security duty. What it requires

Show the other 6 laws

Micronesia	FSM Telecommunications Act of 2014, Security Safeguards for Customer Information	Through its security duty. What it requires
Serbia	Law on Information Security, ICT Systems of Special Importance and Security Measures	Through its security duty. What it requires
Solomon Islands	Telecommunications Act 2009, Security Safeguards for Consumer Information	Through its security duty. What it requires
Taiwan	Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit	Through its security duty. What it requires
Tonga	Cybersecurity Act 2025, Critical Infrastructure Operator Obligations from a date not yet set	Through its security duty. What it requires
Turkmenistan	Law on Communications, network and subscriber-information protection duties	Through its security duty. What it requires

Vulnerability and incident reporting

9 laws, 9 places

Place	Law	How it reaches this control
Angola	Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties	Through its security duty. What it requires
China	Data Security Law, Risk Monitoring and Incident Reporting Duty	Through its security duty. What it requires
Gambia	Information and Communications Act, 2009, security of information and communications services (subscriber risk notification)	Through its breach notice duty. What it requires
Latvia	Nacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation	Through its security duty. What it requires
Marshall Islands	Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations	Through its security duty. What it requires
Micronesia	FSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock proposed	Through its security duty. What it requires
Taiwan	Cyber Security Management Act, Cyber Security Incident Reporting	Through its security duty. What it requires
Tunisia	Cybersecurity Incident Reporting and Emergency Response	Through its security duty. What it requires
Vietnam	Cybersecurity Law, Incident Response and Reporting Duties	Through its security duty. What it requires

Product security requirements

8 laws, 8 places

Place	Law	How it reaches this control
Australia	Security Standards for Smart Devices	Through its security duty. What it requires
Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits	Through its security duty. What it requires
Brazil	Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment)	Through its security duty. What it requires
California	Security of Connected Devices	Through its security duty. What it requires
China	Cybersecurity Law, Network Product and Service Security Duties	Through its security duty. What it requires
Cyprus	Security of Networks and Information Systems Law, Radio Equipment Cybersecurity Requirements	Through its security duty. What it requires
Oregon	Security requirements for Internet-connected devices	Through its security duty. What it requires
United Kingdom	Product Security Requirements for Connectable Products	Through its security duty. What it requires

Sensitive categories

5 laws, 5 places

Place	Law	How it reaches this control
Angola	Law on the Protection of Personal Data, sensitive data categories	Through its security duty. What it requires
Cabo Verde	Law No. 133/V/2001 on the Protection of Personal Data, sensitive data categories	Through its security duty. What it requires
Morocco	Law No. 09-08, sensitive personal data and offense records	Through its security duty. What it requires
Rwanda	Law relating to the Protection of Personal Data and Privacy, sensitive personal data and children's data	Through its security duty. What it requires
Sao Tome and Principe	Lei n.º 03/2016, sensitive categories and suspect records	Through its security duty. What it requires

Cross border transfer

3 laws, 3 places

Place	Law	How it reaches this control
Cuba	Resolución 58/2022 (MINCOM), security and localization rules for personal data in electronic form	Through its breach notice, security duties. What it requires
Niger	Loi n° 2022-59, transfert transfrontalier des données	Through its security duty. What it requires
United States	DOJ Data Security Program (Bulk Sensitive Personal Data Rule)	Through its security duty. What it requires

AI risk obligations

2 laws, 2 places

Place	Law	How it reaches this control
European Union	AI Act, Article 15 (accuracy, robustness and cybersecurity) from 2 Dec 2027, in 14 months	Through its security duty. What it requires
Vietnam	Law on Artificial Intelligence, incident management and reporting obligation	Through its breach notice duty. What it requires

Enforcement supervision

1 law, 1 place

Place	Law	How it reaches this control
Zimbabwe	Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024	Through its security duty. What it requires

Full text of the FINOS AI Governance Framework, CC BY 4.0. FINOS AI Governance Framework, https://air-governance-framework.finos.org/, copyright 2025 FINOS, licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Titles and purpose text are quoted; markdown emphasis and links were removed. Every control of the framework.

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.