FINOS AIGF AIR-DET-004, AI System Observability: the laws that bear on it

Comprehensive regime

86 laws, 83 places

Place	Law	How it reaches this control
Albania	Law No. 124/2024 On the Protection of Personal Data	Through its governance duty. What it requires
Algeria	Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11	Through its governance duty. What it requires
Andorra	LQPD, Llei 29/2021 del 28 d'octubre	Through its governance duty. What it requires
Antigua and Barbuda	Data Protection Act, 2013	Through its retention duty. What it requires
Argentina	Ley 25.326, Ley de Protección de los Datos Personales	Through its governance, retention duties. What it requires
Barbados	Data Protection Act, 2019	Through its governance duty. What it requires
Belarus	Law of the Republic of Belarus On Personal Data Protection	Through its governance duty. What it requires
Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel)	Through its governance, retention duties. What it requires
Bosnia and Herzegovina	Law on the Protection of Personal Data of Bosnia and Herzegovina	Through its governance duty. What it requires
Botswana	Data Protection Act, 2024 (Act No. 18 of 2024)	Through its governance duty. What it requires

Show the other 76 laws

Brazil	Lei Geral de Proteção de Dados Pessoais (LGPD)	Through its governance, retention duties. What it requires
Burkina Faso	Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel	Through its governance, retention duties. What it requires
California	California Consumer Privacy Act, as amended by the California Privacy Rights Act (Proposition 24)	Through its retention duty. What it requires
California	CCPA Cybersecurity Audit Regulations	Through its reporting duty. What it requires
Cambodia	Draft Law on Personal Data Protection, final draft proposed	Through its governance duty. What it requires
Cameroon	Loi n°2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun from a date not yet set	Through its breach notice, governance duties. What it requires
Central African Republic	Loi n° 24.001 portant protection des données à caractère personnel	Through its governance, retention duties. What it requires
Chad	Loi n°007/PR/2015, principes directeurs du traitement des données (consentement, licéité, finalité, conservation)	Through its retention duty. What it requires
Colombia	Ley 1581 de 2012, General Personal Data Protection	Through its governance duty. What it requires
Comoros	Law on the Protection of Personal Data	Through its governance, retention duties. What it requires
Cuba	Ley 149/2022, De Protección de Datos Personales, general regime	Through its breach notice duty. What it requires
Côte d'Ivoire	Law No. 2013-450 on the Protection of Personal Data	Through its governance, retention duties. What it requires
Democratic Republic of the Congo	Digital Code, Title III: Personal Data Protection	Through its governance, retention duties. What it requires
Djibouti	Digital Code, Book I: Personal Data Protection and CNDP	Through its governance duty. What it requires
Dominican Republic	Ley No. 172-13 sobre Protección Integral de los Datos Personales	Through its governance duty. What it requires
Ecuador	LOPDP, comprehensive personal-data protection regime	Through its governance duty. What it requires
Egypt	Law No. 151 of 2020 Promulgating the Personal Data Protection Law	Through its governance, retention duties. What it requires
El Salvador	Ley para la Protección de Datos Personales	Through its governance, retention duties. What it requires
Eswatini	Data Protection Act, 2022 (Act No. 5 of 2022)	Through its governance, retention duties. What it requires
Ethiopia	Personal Data Protection Proclamation	Through its governance, retention duties. What it requires
European Union	General Data Protection Regulation (GDPR), Comprehensive Regime	Through its governance duty. What it requires
Gabon	Loi n°001/2011 relative à la protection des données à caractère personnel, modifiée par la loi n°025/2023	Through its governance, retention duties. What it requires
Gambia	Personal Data Protection and Privacy Act, 2025 from a date not yet set	Through its governance duty. What it requires
Grenada	Data Protection Act, No. 1 of 2023 from a date not yet set	Through its governance, retention duties. What it requires
Jamaica	Data Protection Act, 2020, registration, lawful basis and standards for processing	Through its governance, retention duties. What it requires
Kiribati	Data Protection Act 2025 from a date not yet set	Through its retention duty. What it requires
Kosovo	Law No. 06/L-082 on Protection of Personal Data	Through its governance duty. What it requires
Lebanon	Law No. 81/2018 on Electronic Transactions and Personal Data, Part V (Personal Data Protection)	Through its governance, retention duties. What it requires
Lesotho	Data Protection Act, 2011 (Act No. 5 of 2012)	Through its governance, retention duties. What it requires
Liberia	Telecommunications Act of 2007, Protection of Personal Information (§§ 51-52)	Through its governance duty. What it requires
Madagascar	Law No. 2014-038, protection of personal data	Through its governance, retention duties. What it requires
Malawi	Electronic Transactions and Cyber Security Act, 2016, personal data processing and security duties (Part VII)	Through its retention duty. What it requires
Maldives	Personal Data Protection Bill, pending before the People's Majlis proposed	Through its governance, retention duties. What it requires
Mali	Loi n° 2013-015, protection des données à caractère personnel	Through its governance, reporting duties. What it requires
Marshall Islands	Personal Data Protection Act 2025, government personal-data protection principles	Through its governance, retention duties. What it requires
Mauritania	Loi n° 2017-020, protection des données à caractère personnel	Through its governance, retention duties. What it requires
Mexico	Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP)	Through its governance, retention duties. What it requires
Moldova	Law No. 195/2024 on Personal Data Protection	Through its governance duty. What it requires
Monaco	Loi sur la Protection des Données Personnelles	Through its governance, retention duties. What it requires
Montenegro	Law on Personal Data Protection from a date not yet set	Through its governance duty. What it requires
Morocco	Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data	Through its governance, retention duties. What it requires
Mozambique	Electronic Transactions Law, Protection of Personal Electronic Data	Through its governance duty. What it requires
Nauru	Communications and Broadcasting Act 2018, confidentiality of subscriber information and communications	Through its retention duty. What it requires
Nicaragua	Ley No. 787, Ley de Protección de Datos Personales	Through its governance, retention duties. What it requires
Niger	Loi n° 2022-59, protection des données à caractère personnel	Through its governance, retention duties. What it requires
Nigeria	Nigeria Data Protection Act, 2023 (NDPA), general data protection duties	Through its governance, reporting duties. What it requires
North Macedonia	Law on Personal Data Protection (LPDP)	Through its governance duty. What it requires
North Macedonia	Law on Personal Data Protection (LPDP), video surveillance	Through its retention duty. What it requires
Panama	Ley 81 de 2019, Sobre Protección de Datos Personales	Through its governance, retention duties. What it requires
Paraguay	Ley N° 7593/2025, de Protección de Datos Personales en la República del Paraguay from 27 Nov 2027, in 14 months	Through its governance duty. What it requires
Peru	Ley 29733, Ley de Protección de Datos Personales	Through its governance, retention duties. What it requires
Republic of the Congo	Law No. 29-2019 on the Protection of Personal Data	Through its governance duty. What it requires
Rwanda	Law relating to the Protection of Personal Data and Privacy	Through its governance, retention duties. What it requires
Saint Kitts and Nevis	Data Protection Act, 2018 from a date not yet set	Through its retention duty. What it requires
Saint Lucia	Data Protection Act	Through its retention duty. What it requires
San Marino	San Marino Law No. 171 on the Protection of Natural Persons	Through its governance duty. What it requires
Sao Tome and Principe	Lei n.º 03/2016, Protecção de Dados Pessoais	Through its governance duty. What it requires
Senegal	Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel (Personal Data Protection Act)	Through its governance, retention duties. What it requires
Serbia	Law on Personal Data Protection	Through its governance duty. What it requires
Solomon Islands	Telecommunications Act 2009, Confidentiality and Consent Duties	Through its retention duty. What it requires
Somalia	Data Protection Act No. 005 of 2023	Through its governance duty. What it requires
South Africa	Protection of Personal Information Act 4 of 2013 (POPIA)	Through its governance, retention duties. What it requires
Suriname	Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens) proposed	Through its governance, retention duties. What it requires
Syria	Law No. 12 of 2024 on Protection of Electronic Personal Data	Through its governance, retention duties. What it requires
Taiwan	Personal Data Protection Act (個人資料保護法)	Through its breach notice, reporting duties. What it requires
Togo	Loi n° 2019-014, protection des données à caractère personnel	Through its governance, retention duties. What it requires
Tonga	Privacy Act 2025, comprehensive personal information protection regime from a date not yet set	Through its retention duty. What it requires
Trinidad and Tobago	Data Protection Act, 2011	Through its governance, retention duties. What it requires
Tunisia	Organic Act on the Protection of Personal Data	Through its governance, retention duties. What it requires
Uganda	Data Protection and Privacy Act, 2019, comprehensive personal-data regime	Through its governance, retention duties. What it requires
Ukraine	Draft Law No. 8153 on Personal Data Protection (GDPR-Aligned Reform) proposed	Through its governance duty. What it requires
Ukraine	Law of Ukraine On the Protection of Personal Data	Through its governance, reporting duties. What it requires
Uruguay	Ley N° 18.331, Personal Data Protection and Habeas Data Law, as amended	Through its governance, retention duties. What it requires
Vatican City	General Regulation on the Protection of Personal Data for Vatican City State	Through its governance duty. What it requires
Zambia	Data Protection Act, 2021, personal data processing framework	Through its governance, retention duties. What it requires
Zimbabwe	Cyber and Data Protection Act [Chapter 12:07]	Through its governance duty. What it requires

Breach notification

71 laws, 70 places

Place	Law	How it reaches this control
Albania	Law No. 124/2024, notification of a personal data breach	Through its breach notice, reporting duties. What it requires
Algeria	Loi n° 18-07 relative à la protection des personnes physiques, notification des violations de données	Through its breach notice, reporting duties. What it requires
Andorra	LQPD, personal data breach notification	Through its breach notice, reporting duties. What it requires
Barbados	Data Protection Act, 2019, personal data breach notification	Through its breach notice, reporting duties. What it requires
Belarus	Law of the Republic of Belarus On Personal Data Protection, notification of personal data protection violations	Through its breach notice, reporting duties. What it requires
Belize	Data Protection Act 2021, personal data breach notification from a date not yet set	Through its breach notice duty. What it requires
Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, notification des ruptures de sécurité	Through its breach notice, reporting duties. What it requires
Bosnia and Herzegovina	Law on the Protection of Personal Data of Bosnia and Herzegovina, personal data breach notification	Through its breach notice, reporting duties. What it requires
Botswana	Data Protection Act, 2024, personal data breach notification	Through its breach notice duty. What it requires
Brazil	LGPD, security incident notification	Through its breach notice, reporting duties. What it requires

Show the other 61 laws

California	California Data Breach Notification Law, as amended by SB 446	Through its breach notice duty. What it requires
Cambodia	Cambodia's Draft Law on Personal Data Protection, personal data breach notification proposed	Through its breach notice, reporting duties. What it requires
Cayman Islands	Data Protection Act 2021 Revision, personal data breach notification	Through its breach notice, reporting duties. What it requires
Chad	Loi n°007/PR/2015, obligation de notification des violations de données à l'ANSICE	Through its breach notice duty. What it requires
Colombia	Ley 1581 de 2012, Security Breach Notification to the Authority	Through its breach notice, reporting duties. What it requires
Connecticut	Breach of security re computerized data containing personal information from a date not yet set	Through its breach notice duty. What it requires
Democratic Republic of the Congo	Digital Code, Title III, personal data breach notification	Through its breach notice, reporting duties. What it requires
District of Columbia	Consumer Security Breach Notification	Through its breach notice duty. What it requires
Djibouti	Digital Code, Book I: personal-data breach notification	Through its breach notice, reporting duties. What it requires
Ecuador	LOPDP, notificación de vulneración de seguridad	Through its breach notice, reporting duties. What it requires
Egypt	Egypt Personal Data Protection Law, Personal Data Infringement notification	Through its breach notice, reporting duties. What it requires
El Salvador	Ley para la Protección de Datos Personales, personal data breach notification	Through its breach notice, reporting duties. What it requires
Eswatini	Data Protection Act, 2022, notification of security compromises	Through its breach notice duty. What it requires
Ethiopia	Personal Data Protection Proclamation, personal data breach notification	Through its breach notice, reporting duties. What it requires
European Union	GDPR Articles 33-34, Breach Notification	Through its breach notice duty. What it requires
Gabon	Law No. 025/2023, personal-data breach notification	Through its breach notice, reporting duties. What it requires
Gambia	Personal Data Protection and Privacy Act, 2025, personal data breach notification from a date not yet set	Through its breach notice, reporting duties. What it requires
Ghana	Data Protection Act, notification of security compromises	Through its breach notice duty. What it requires
Guam	Notification of Breaches of Personal Information	Through its breach notice duty. What it requires
Illinois	Personal Information Protection Act, data breach notification	Through its breach notice duty. What it requires
Ireland	GDPR Articles 33-34, Breach Notification in Ireland	Through its breach notice duty. What it requires
Jamaica	Data Protection Act, 2020, reporting a contravention or security breach	Through its breach notice, reporting duties. What it requires
Kiribati	Data Protection Act 2025, personal data breaches from a date not yet set	Through its breach notice, reporting duties. What it requires
Kosovo	Law No. 06/L-082 on Protection of Personal Data, personal data breach notification	Through its breach notice, reporting duties. What it requires
Lesotho	Data Protection Act, 2011, notification of security compromises	Through its breach notice duty. What it requires
Maldives	Maldives Personal Data Protection Bill, personal data breach notification proposed	Through its breach notice, reporting duties. What it requires
Maryland	Maryland Personal Information Protection Act (MPIPA), breach notification from a date not yet set	Through its breach notice duty. What it requires
Mexico	Ley Federal de Protección de Datos Personales en Posesión de los Particulares, security-breach notice	Through its breach notice duty. What it requires
Moldova	Moldova Law No. 195/2024, personal data breach notification	Through its breach notice, reporting duties. What it requires
Monaco	Loi sur la Protection des Données Personnelles, notification des violations de données	Through its breach notice, reporting duties. What it requires
Nevada	Security breach of personal information, notification from a date not yet set	Through its breach notice duty. What it requires
New Hampshire	Notice of Security Breach	Through its breach notice duty. What it requires
Nicaragua	Ley No. 787, Ley de Protección de Datos Personales, security incident notice	Through its breach notice duty. What it requires
Niger	Loi n° 2022-59, notification des violations de données	Through its breach notice, reporting duties. What it requires
Nigeria	Nigeria Data Protection Act, 2023, data breach notification	Through its breach notice, reporting duties. What it requires
North Carolina	Identity Theft Protection Act, security breach notification from a date not yet set	Through its breach notice duty. What it requires
North Macedonia	Law on Personal Data Protection (LPDP), personal data breach notification	Through its breach notice, reporting duties. What it requires
Panama	Ley 81 de 2019, personal data breach notification	Through its breach notice duty. What it requires
Paraguay	Ley N° 7593/2025, notificación de un incidente de seguridad from 27 Nov 2027, in 14 months	Through its breach notice, reporting duties. What it requires
Puerto Rico	Ley de Información al Ciudadano sobre la Seguridad de Bancos de Información (data breach notification)	Through its breach notice, reporting duties. What it requires
Republic of the Congo	Law No. 29-2019, personal-data breach notification	Through its breach notice, reporting duties. What it requires
Rwanda	Law relating to the Protection of Personal Data and Privacy, personal data breach notification	Through its breach notice, reporting duties. What it requires
Samoa	National Digital Identification Act 2024, personal data breach notification	Through its breach notice duty. What it requires
San Marino	San Marino Law No. 171, personal data breach notification	Through its breach notice, reporting duties. What it requires
Serbia	Law on Personal Data Protection, personal data breach notification	Through its breach notice, reporting duties. What it requires
Somalia	Data Protection Act, 2023, personal data breach notification	Through its breach notice, reporting duties. What it requires
South Africa	Protection of Personal Information Act, notification of security compromises	Through its breach notice, reporting duties. What it requires
South Carolina	Business data breach of security, notification statute	Through its breach notice, reporting duties. What it requires
Suriname	Draft Law on the Protection of Privacy and Personal Data, breach notification proposed	Through its breach notice duty. What it requires
Syria	Law No. 12 of 2024 on Protection of Electronic Personal Data, personal data breach notification	Through its breach notice, reporting duties. What it requires
Tonga	Privacy Act 2025, personal information breaches from a date not yet set	Through its breach notice, reporting duties. What it requires
Uganda	Data Protection and Privacy Act, 2019, breach notification	Through its breach notice, reporting duties. What it requires
Ukraine	Draft Law No. 8153, personal data breach notification proposed	Through its breach notice, reporting duties. What it requires
United Kingdom	UK GDPR Articles 33-34 and PECR, Breach Notification in the United Kingdom	Through its breach notice duty. What it requires
United States	HIPAA Breach Notification Rule	Through its breach notice duty. What it requires
Uruguay	Ley N° 19.670, personal data breach notification	Through its breach notice, reporting duties. What it requires
Virginia	Breach of personal information notification from a date not yet set	Through its breach notice duty. What it requires
Washington	Notice of security breaches involving personal information	Through its breach notice duty. What it requires
Zambia	Data Protection Act, 2021, notification of a security breach	Through its breach notice, reporting duties. What it requires
Zimbabwe	Cyber and Data Protection Act, security breach notification	Through its breach notice, reporting duties. What it requires
Zimbabwe	Cyber and Data Protection Regulations 2024, security breach notification	Through its breach notice, reporting duties. What it requires

Vulnerability and incident reporting

68 laws, 62 places

Place	Law	How it reaches this control
Andorra	Llei 22/2022, Incident Handling and Notification Obligation	Through its reporting duty. What it requires
Angola	Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties	Through its reporting duty. What it requires
Austria	Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations	Through its reporting duty. What it requires
Bangladesh	Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident	Through its reporting duty. What it requires
Belgium	Loi du 26 avril 2024, Significant-Incident Notification Obligations	Through its reporting duty. What it requires
Bulgaria	Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS)	Through its reporting duty. What it requires
China	Data Security Law, Risk Monitoring and Incident Reporting Duty	Through its reporting duty. What it requires
China	National Cybersecurity Incident Reporting Measures	Through its reporting duty. What it requires
Croatia	Zakon o kibernetičkoj sigurnosti and Uredba o kibernetičkoj sigurnosti, Incident and Cyber-Threat Reporting Obligations	Through its reporting duty. What it requires
Cuba	Resolución 105/2021, Reglamento sobre el Modelo de Actuación Nacional para la Respuesta a Incidentes de Ciberseguridad	Through its reporting duty. What it requires

Show the other 58 laws

Cyprus	Security of Networks and Information Systems Law, Incident Notification Obligations	Through its reporting duty. What it requires
Czech Republic	Cybersecurity Act (Zákon o kybernetické bezpečnosti), Incident Notification	Through its reporting duty. What it requires
Côte d'Ivoire	Mandatory Reporting of Attacks and Intrusions to ARTCI	Through its reporting duty. What it requires
Democratic Republic of the Congo	Digital Code, Livre II: Trust Service Provider Security-Incident Notification	Through its reporting duty. What it requires
Democratic Republic of the Congo	Digital Code, Livre IV: General Cyberattack Cooperation and Incident-Reporting Duty	Through its reporting duty. What it requires
Denmark	NIS 2-loven, Significant-Incident Reporting and Recipient-Notice Duties	Through its reporting duty. What it requires
Djibouti	Digital Code, Book VII: National Health Data System Security Incident Reporting	Through its reporting duty. What it requires
Estonia	Küberturvalisuse seadus (KüTS), Duty to Notify of a Cyber Incident	Through its reporting duty. What it requires
Ethiopia	Computer Crime Proclamation, Duty to Report Computer Crime and Illegal Content	Through its reporting duty. What it requires
Ethiopia	Critical Infrastructure Cybersecurity Proclamation, Cyber Incident Reporting to National CERT from 21 Jul 2027, in 9 months	Through its reporting duty. What it requires
European Union	Cyber Resilience Act, Manufacturer Reporting Obligations	Through its reporting duty. What it requires
European Union	DORA, Article 19 (reporting of major ICT-related incidents), with the time limits of Delegated Regulation (EU) 2025/301	Through its reporting duty. What it requires
European Union	NIS2 Directive, Reporting Obligations	Through its reporting duty. What it requires
Finland	Kyberturvallisuuslaki, Significant-Incident Reporting Obligations	Through its reporting duty. What it requires
France	Loi n° 2018-133 du 26 février 2018 (transposition NIS1), Incident Notification	Through its reporting duty. What it requires
Gambia	Information and Communications Act, 2009, security of information and communications services (subscriber risk notification)	Through its breach notice duty. What it requires
Germany	BSI-Gesetz (BSIG), Incident Notification	Through its reporting duty. What it requires
Ghana	Cybersecurity Act, Duty to Report Cybersecurity Incident	Through its reporting duty. What it requires
Greece	Law 5160/2024, Significant-Incident Reporting Obligations	Through its reporting duty. What it requires
Hungary	Cybersecurity Act, Incident Notification and Cybersecurity Fine	Through its reporting duty. What it requires
Iceland	Notification of Serious Incidents and Risk to the National Cybersecurity Incident-Response Team	Through its reporting duty. What it requires
India	CERT-In Cyber Security Directions, Incident Reporting, Logging and Time Synchronisation	Through its reporting duty. What it requires
Indonesia	Government Regulation on the Operation of Electronic Systems and Transactions, security-incident reporting duty	Through its reporting duty. What it requires
Ireland	European Union (NIS) Regulations 2018, Incident Notification	Through its reporting duty. What it requires
Italy	Decreto Legislativo 4 settembre 2024, n. 138 (Decreto NIS2), Incident Notification	Through its reporting duty. What it requires
Jordan	Cyber Security Law No. 16 of 2019, Article 8 private-sector incident-reporting and Center-cooperation duty	Through its reporting duty. What it requires
Kenya	Computer Misuse and Cybercrimes Act, Reporting of Cyber Threat	Through its reporting duty. What it requires
Kiribati	Cybersecurity Act 2026, Duty to Report a Cybersecurity Incident from a date not yet set	Through its reporting duty. What it requires
Kyrgyzstan	Digital Code, digital resilience incident notification	Through its reporting duty. What it requires
Latvia	Nacionālās kiberdrošības likums, Incident Notification	Through its reporting duty. What it requires
Liechtenstein	Cyber-Sicherheitsgesetz (CSG), Incident Notification	Through its reporting duty. What it requires
Lithuania	Kibernetinio saugumo įstatymas (Law on Cyber Security), Incident Notification	Through its reporting duty. What it requires
Luxembourg	Loi du 5 mai 2026 relative à la cybersécurité (NIS2), Incident Notification	Through its reporting duty. What it requires
Malta	Gaming Authorisations and Compliance Directive, Notification of Information Security Breaches	Through its reporting duty. What it requires
Malta	Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, Significant-Incident Reporting to the National CSIRT	Through its reporting duty. What it requires
Marshall Islands	Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations	Through its reporting duty. What it requires
Mongolia	Law on Cyber Security, Cyber-Attack Notification Duty for Other Legal Persons	Through its reporting duty. What it requires
Montenegro	Law on Information Security, Cyber Threat and Incident Reporting	Through its reporting duty. What it requires
Morocco	Loi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Incident and Vulnerability Notification Duties	Through its reporting duty. What it requires
Mozambique	Cybersecurity Law, Incident Notification and Responsible Vulnerability Disclosure	Through its reporting duty. What it requires
Netherlands	Cyberbeveiligingswet, Significant-Incident Reporting Obligations	Through its reporting duty. What it requires
New York	New York Department of Financial Services Cybersecurity Regulation, Notices to the Superintendent	Through its reporting duty. What it requires
Nigeria	Cybercrimes (Prohibition, Prevention, etc.) Act, 2015, Reporting of Cyber Threats to the National CERT	Through its reporting duty. What it requires
Portugal	Regime Jurídico da Cibersegurança, Significant-Incident Reporting Obligations	Through its reporting duty. What it requires
Romania	Ordonanța de urgență nr. 155/2024, Incident Notification	Through its reporting duty. What it requires
Serbia	Law on Information Security, Incident Reporting Obligations	Through its reporting duty. What it requires
Sierra Leone	Cyber Security and Crime Act, 2021, Reporting of Cyber Security Incidents	Through its reporting duty. What it requires
Slovakia	Zákon o kybernetickej bezpečnosti (Cybersecurity Act), Incident and Vulnerability Notification	Through its reporting duty. What it requires
Slovenia	Zakon o informacijski varnosti (ZInfV-1), Significant-Incident Notification Obligations	Through its reporting duty. What it requires
South Korea	Information and Communications Network Act, Report on Computer Security Incidents	Through its reporting duty. What it requires
Spain	Real Decreto-ley 12/2018, Incident Notification Obligation	Through its reporting duty. What it requires
Sweden	Cybersäkerhetslag, Incident Notification	Through its reporting duty. What it requires
Taiwan	Cyber Security Management Act, Cyber Security Incident Reporting	Through its reporting duty. What it requires
Tonga	Cybersecurity Act 2025, Duty to Report a Cybersecurity Incident from a date not yet set	Through its reporting duty. What it requires
Tunisia	Cybersecurity Incident Reporting and Emergency Response	Through its reporting duty. What it requires
Turkey	Cybersecurity Law, Reporting and Cooperation Duties	Through its reporting duty. What it requires
Ukraine	Law on the Basic Principles of Ensuring Cybersecurity, CERT-UA Incident Notification Duty	Through its reporting duty. What it requires
Vietnam	Cybersecurity Law, Incident Response and Reporting Duties	Through its reporting duty. What it requires

Enforcement supervision

66 laws, 66 places

Place	Law	How it reaches this control
Albania	Law No. 124/2024, Commissioner, remedies, liability and penalties	Through its governance, reporting duties. What it requires
Algeria	Loi n° 18-07 relative à la protection des personnes physiques, contrôle, sanctions et voies de recours	Through its governance, reporting duties. What it requires
Andorra	LQPD, the Andorran Data Protection Agency, its powers, infractions and sanctions	Through its governance, reporting duties. What it requires
Angola	Law on the Protection of Personal Data, enforcement and supervision	Through its governance, reporting duties. What it requires
Antigua and Barbuda	Data Protection Act, 2013, information commissioner and enforcement	Through its governance, reporting duties. What it requires
Argentina	Ley 25.326, enforcement, sanctions, and the habeas data action	Through its governance, reporting duties. What it requires
Bahamas	Data Protection Act 2003, Commissioner, enforcement and penalties	Through its governance, reporting duties. What it requires
Barbados	Data Protection Act, 2019, the Commissioner, enforcement and penalties	Through its governance, reporting duties. What it requires
Belarus	Law of the Republic of Belarus On Personal Data Protection, authorized agency and liability	Through its governance, reporting duties. What it requires
Belize	Data Protection Act 2021, Commissioner, Tribunal, and enforcement from a date not yet set	Through its governance, reporting duties. What it requires

Show the other 56 laws

Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, Autorité de Protection des Données Personnelles, sanctions et infractions pénales	Through its governance, reporting duties. What it requires
Bermuda	Personal Information Protection Act 2016, Commissioner, enforcement and offences	Through its governance, reporting duties. What it requires
Bosnia and Herzegovina	Law on the Protection of Personal Data of Bosnia and Herzegovina, the Agency, enforcement and penalties	Through its governance, reporting duties. What it requires
Brazil	LGPD, civil liability, administrative sanctions and the ANPD	Through its governance, reporting duties. What it requires
Burkina Faso	Personal Data Protection Law, supervisory authority and sanctions	Through its governance, reporting duties. What it requires
Cabo Verde	Law No. 133/V/2001 on the Protection of Personal Data, enforcement and supervision	Through its governance, reporting duties. What it requires
Cameroon	Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, article 74 (atteinte à la vie privée et traitement illicite des données à caractère personnel)	Through its retention duty. What it requires
Cayman Islands	Data Protection Act 2021 Revision, Ombudsman enforcement, monetary penalties and offences	Through its governance, reporting duties. What it requires
Chad	Loi n°007/PR/2015, sanctions administratives et pénales et recours	Through its governance duty. What it requires
China	Personal Information Protection Law, Supervision and Legal Liability	Through its governance duty. What it requires
Colombia	SIC Circular on AI, Demonstrated Accountability	Through its governance duty. What it requires
Comoros	Law on the Protection of Personal Data, the Commission and sanctions	Through its governance, reporting duties. What it requires
Côte d'Ivoire	Law No. 2013-450 on the Protection of Personal Data, enforcement and the Protection Body	Through its governance, reporting duties. What it requires
Democratic Republic of the Congo	Digital Code, Data Protection Authority and sanctions	Through its governance, reporting duties. What it requires
Djibouti	Digital Code, Book I: the Commission, administrative sanctions and criminal offences	Through its governance, reporting duties. What it requires
Egypt	Egypt Personal Data Protection Law, the Center, judicial control and penalties	Through its governance, reporting duties. What it requires
Eswatini	Data Protection Act, 2022, enforcement and offences	Through its governance, reporting duties. What it requires
Ethiopia	Personal Data Protection Proclamation, enforcement, sanctions and offences	Through its governance, reporting duties. What it requires
Gabon	Law No. 025/2023, recourse, oversight and sanctions	Through its governance, reporting duties. What it requires
Gambia	Personal Data Protection and Privacy Act, 2025, the Information Commission, offences and penalties from a date not yet set	Through its governance duty. What it requires
Ghana	Data Protection Act, enforcement, offences and penalties	Through its governance, reporting duties. What it requires
Grenada	Data Protection Act, No. 1 of 2023, Information Commission, enforcement and offences from a date not yet set	Through its governance, reporting duties. What it requires
Idaho	Student Data Accessibility, Transparency and Accountability Act (SDATAA) from a date not yet set	Through its governance, retention duties. What it requires
Jamaica	Data Protection Act, 2020, the Information Commissioner, penalties and compensation	Through its reporting duty. What it requires
Kiribati	Data Protection Act 2025, enforcement, offences and civil remedies from a date not yet set	Through its governance, reporting duties. What it requires
Kosovo	Law No. 06/L-082 on Protection of Personal Data, remedies, the Agency, inspections and penalties	Through its governance, reporting duties. What it requires
Lesotho	Data Protection Act, 2011, enforcement and offences	Through its governance, reporting duties. What it requires
Libya	Law No. 6 of 2022, supervisory authority, licensing and penalties	Through its governance duty. What it requires
Madagascar	Law No. 2014-038, CMIL, sanctions and offences	Through its governance, reporting duties. What it requires
Mali	Loi n° 2013-015, the Autorité, supervision, and sanctions	Through its governance, reporting duties. What it requires
Marshall Islands	Personal Data Protection Act 2025, competent authority, remedies, and complaints	Through its governance, reporting duties. What it requires
Mauritania	Loi n° 2017-020, Autorité de Protection des Données et sanctions	Through its governance, reporting duties. What it requires
Moldova	Moldova Law No. 195/2024, the Centre, complaints, compensation and sanctions	Through its governance, reporting duties. What it requires
Monaco	Loi sur la Protection des Données Personnelles, autorité de contrôle et sanctions	Through its governance, reporting duties. What it requires
Montenegro	Law on Personal Data Protection, agency, supervision and penal provisions from a date not yet set	Through its governance, reporting duties. What it requires
Morocco	Law No. 09-08, the CNDP and sanctions	Through its governance, reporting duties. What it requires
Nicaragua	Ley No. 787, Ley de Protección de Datos Personales, supervision, sanctions, and complaints	Through its governance, reporting duties. What it requires
Niger	Loi n° 2022-59, contrôle, sanctions et recours	Through its governance, reporting duties. What it requires
Nigeria	Nigeria Data Protection Act, 2023, complaints, enforcement and redress	Through its governance, reporting duties. What it requires
North Macedonia	Law on Personal Data Protection (LPDP), the Agency, supervision and misdemeanour provisions	Through its governance, reporting duties. What it requires
Panama	Ley 81 de 2019, enforcement and sanctions	Through its governance, reporting duties. What it requires
Peru	Ley 29733, enforcement, supervisory authority and sanctions	Through its governance, reporting duties. What it requires
Rwanda	Law relating to the Protection of Personal Data and Privacy, supervisory authority, penalties and offences	Through its governance, reporting duties. What it requires
Saint Kitts and Nevis	Data Protection Act, 2018, Information Commissioner, enforcement and offences from a date not yet set	Through its governance, reporting duties. What it requires
San Marino	San Marino Law No. 171, the Data Protection Authority, remedies and fines	Through its governance, reporting duties. What it requires
Senegal	Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel, Commission des Données Personnelles et sanctions	Through its governance, reporting duties. What it requires
Somalia	Data Protection Act, 2023, complaints, orders of the Authority and civil remedies	Through its governance, reporting duties. What it requires
South Africa	Protection of Personal Information Act, the Information Regulator, enforcement and penalties	Through its governance, reporting duties. What it requires
Suriname	Draft Law on the Protection of Privacy and Personal Data, Commissioner, remedies and fines proposed	Through its governance duty. What it requires
Syria	Law No. 12 of 2024 on Protection of Electronic Personal Data, Authority, complaints and penalties	Through its governance, reporting duties. What it requires
Togo	Loi n° 2019-014, cadre institutionnel et dispositions pénales	Through its governance, reporting duties. What it requires
Tonga	Privacy Act 2025, penalties, enforcement and third party actions from a date not yet set	Through its governance, reporting duties. What it requires
Trinidad and Tobago	Data Protection Act, 2011, Commissioner, contravention and enforcement	Through its governance duty. What it requires
Tunisia	Organic Act on the Protection of Personal Data, enforcement and sanctions	Through its governance, reporting duties. What it requires
Vanuatu	Data Protection and Privacy Act 2024, enforcement powers and offences	Through its governance, reporting duties. What it requires
Zimbabwe	Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024	Through its governance, reporting duties. What it requires

Sector security regimes

45 laws, 43 places

Place	Law	How it reaches this control
Albania	Law No. 25/2024, On Cybersecurity	Through its governance, reporting duties. What it requires
Andorra	Llei 22/2022, Cybersecurity Risk-Management Obligations	Through its governance duty. What it requires
Austria	Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures	Through its governance duty. What it requires
Belgium	Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance	Through its governance duty. What it requires
Bulgaria	Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS)	Through its governance duty. What it requires
Central African Republic	Cybersecurity Law: Mandatory Security Audit Regime	Through its reporting duty. What it requires
Croatia	Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance	Through its governance duty. What it requires
Cyprus	Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance	Through its governance duty. What it requires
Czech Republic	Cybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures	Through its governance duty. What it requires
Denmark	NIS 2-loven, Cybersecurity Risk-Management Measures and Registration	Through its governance duty. What it requires

Show the other 35 laws

Djibouti	Digital Code, Book II: Electronic Communications Network and Service Security	Through its reporting duty. What it requires
Estonia	Küberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties	Through its governance duty. What it requires
Ethiopia	Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations from 21 Jul 2027, in 9 months	Through its governance duty. What it requires
European Union	NIS2 Directive, Cybersecurity Risk-Management Measures	Through its governance duty. What it requires
Finland	Kyberturvallisuuslaki, Cybersecurity Risk-Management Measures and Governance	Through its governance duty. What it requires
Germany	BSI-Gesetz (BSIG), Risk-Management Measures for Essential and Important Entities	Through its governance duty. What it requires
Greece	Law 5160/2024, Cybersecurity Risk-Management Measures and Governance	Through its governance duty. What it requires
Haiti	BRH Circulaire 126, Information Security Rules for Financial Institutions	Through its governance duty. What it requires
Hungary	Cybersecurity Act, Risk-Management Measures	Through its governance duty. What it requires
Iceland	Minimum Risk-Management and Preparedness Requirements for Critical Infrastructure	Through its governance duty. What it requires
Italy	Decreto Legislativo 4 settembre 2024, n. 138 (Decreto NIS2), Risk-Management Measures	Through its governance duty. What it requires
Kiribati	Cybersecurity Act 2026, Critical Infrastructure Operator Obligations from a date not yet set	Through its governance duty. What it requires
Lebanon	Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts)	Through its reporting duty. What it requires
Liechtenstein	Cyber-Sicherheitsgesetz (CSG), Risk-Management Measures for Essential and Important Entities	Through its governance duty. What it requires
Lithuania	Kibernetinio saugumo įstatymas (Law on Cyber Security), Risk-Management Measures	Through its governance duty. What it requires
Luxembourg	Loi du 5 mai 2026 relative à la cybersécurité (NIS2), Risk-Management Measures for Essential and Important Entities	Through its governance duty. What it requires
Malta	Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, Risk-Management Measures for Essential and Important Entities	Through its governance duty. What it requires
Marshall Islands	Cybersecurity Act 2025, Cybersecurity of Critical Information Infrastructure	Through its governance duty. What it requires
Montenegro	Law on Information Security, Essential and Important Entities	Through its governance duty. What it requires
Morocco	Loi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Security Duties	Through its retention duty. What it requires
Mozambique	Cybersecurity Law, Sector-Specific Security Requirements for Critical Infrastructure, Essential Services and Digital Providers	Through its governance duty. What it requires
Netherlands	Cyberbeveiligingswet, Cybersecurity Risk-Management Measures and Governance	Through its governance duty. What it requires
Portugal	Regime Jurídico da Cibersegurança, Cybersecurity Risk-Management Measures and Governance	Through its governance duty. What it requires
Romania	Ordonanța de urgență nr. 155/2024, Cybersecurity Risk-Management Measures	Through its governance duty. What it requires
Serbia	Law on Information Security, ICT Systems of Special Importance and Security Measures	Through its governance duty. What it requires
Sierra Leone	Cyber Security and Crime Act, 2021, Critical National Information Infrastructure	Through its governance duty. What it requires
Slovakia	Zákon o kybernetickej bezpečnosti (Cybersecurity Act), Risk-Management Measures	Through its governance duty. What it requires
Slovenia	Zakon o informacijski varnosti (ZInfV-1), Cybersecurity Risk-Management Measures and Governance from 19 Dec 2026, in 2 months	Through its governance duty. What it requires
Somalia	National Cybersecurity Law (2025)	Through its reporting duty. What it requires
Spain	Real Decreto-ley 12/2018, Security Obligations for Operators of Essential Services and Digital Service Providers	Through its governance duty. What it requires
Sweden	Cybersäkerhetslag, Cybersecurity Risk-Management Measures	Through its governance duty. What it requires
Taiwan	Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit	Through its governance, reporting duties. What it requires
Taiwan	Cyber Security Management Act, Specific Non-Government Agency Cyber Security Management	Through its governance duty. What it requires
Taiwan	Telecommunications Management Act, Cyber Security and Critical Infrastructure Protection Plans	Through its governance duty. What it requires
Tonga	Cybersecurity Act 2025, Critical Infrastructure Operator Obligations from a date not yet set	Through its governance, reporting duties. What it requires

Security baseline statutes

16 laws, 16 places

Place	Law	How it reaches this control
Alabama	Data Breach Notification Act, reasonable security measures and disposal of records	Through its retention duty. What it requires
Cameroon	Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC)	Through its governance duty. What it requires
China	Data Security Law, Data Security Protection Obligations	Through its governance duty. What it requires
Florida	Florida Information Protection Act, data security and disposal duty	Through its retention duty. What it requires
Gabon	Sécurité des systèmes d'information (dispositions communes)	Through its governance duty. What it requires
Hawaii	Destruction of Personal Information Records	Through its retention duty. What it requires
Kansas	Kansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information	Through its retention duty. What it requires
Kuwait	Data Classification Policy	Through its governance, retention duties. What it requires
Kyrgyzstan	Digital Code, digital resilience baseline security measures	Through its governance duty. What it requires
Michigan	Identity Theft Protection Act, destruction of data no longer needed	Through its retention duty. What it requires

Show the other 6 laws

Montenegro	Law on Information Security, General Security Measures	Through its governance duty. What it requires
Mozambique	Cybersecurity Law, General Security Requirements for the Public Administration and the Private Sector	Through its governance duty. What it requires
North Carolina	Identity Theft Protection Act, destruction of personal information records	Through its retention duty. What it requires
Peru	Proyecto de Ley 9906/2024-CR, Ley de Seguridad Digital o Ciberseguridad proposed	Through its governance duty. What it requires
Vermont	Document Safe Destruction Act, safe destruction of records containing personal information	Through its retention duty. What it requires
Vietnam	Cybersecurity Law, Information System Classification and Protection Measures	Through its governance duty. What it requires

AI risk obligations

15 laws, 8 places

Place	Law	How it reaches this control
El Salvador	Resolución ANIA 0001/2025, registro obligatorio para decisiones consecuenciales	Through its governance duty. What it requires
European Union	AI Act, Article 10 (data and data governance) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 111(2) (2030 compliance deadline for public-authority-intended systems) from 2 Aug 2030, in 3.8 years	Through its governance duty. What it requires
European Union	AI Act, Article 14 (human oversight) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring) from 2 Dec 2027, in 14 months	Through its governance, reporting duties. What it requires
European Union	AI Act, Article 26(10) (post-remote biometric identification authorisation) from 2 Dec 2027, in 14 months	Through its governance, reporting duties. What it requires
European Union	AI Act, Article 6(3) and (4) (narrow-task derogation from Annex III high-risk classification) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 9 (risk management system) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
Indiana	Downcoding of Health Benefits Claims, automated and AI decision-making (House Enrolled Act 1271, 2026)	Through its governance duty. What it requires
Kyrgyzstan	Digital Code, Chapter 23: AI system design and risk-management obligations	Through its governance duty. What it requires

Show the other 5 laws

Malta	Artificial Intelligence (Designation of the Information and Data Protection Commissioner for the purposes of Regulation (EU) 2024/1689) Regulations, 2025 (L.N. 227 of 2025)	Through its governance duty. What it requires
Montana	Right to Compute Act (SB 212, 2025), critical AI infrastructure risk management duty	Through its governance duty. What it requires
South Korea	AI Framework Act, Article 34 (business-operator duties for high-impact AI)	Through its governance duty. What it requires
Vietnam	Law on Artificial Intelligence, incident management and reporting obligation	Through its breach notice duty. What it requires
Vietnam	Law on Artificial Intelligence, risk classification and conformity assessment	Through its governance, reporting duties. What it requires

AI governance

12 laws, 8 places

Place	Law	How it reaches this control
California	Transparency in Frontier Artificial Intelligence Act (SB 53)	Through its governance, reporting duties. What it requires
European Union	AI Act, Article 12 (record-keeping) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 19 (automatically generated logs) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 21(2) (competent authority access to automatically generated logs) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 26(6) (deployer log-keeping) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	Digital Services Act, Article 37 (independent audit of very large online platforms and search engines)	Through its reporting duty. What it requires
Germany	Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act	Through its governance, reporting duties. What it requires
Illinois	Artificial Intelligence Safety Measures Act from 1 Jan 2027, in 3 months	Through its governance, reporting duties. What it requires
Russia	Federal Law No. 243-FZ, Article 8, Duties of Sovereign and National Foundation Model Developers from 1 Mar 2027, in 5 months	Through its governance duty. What it requires
South Korea	AI Framework Act, Article 32 (safety-assurance duty for high-compute AI systems)	Through its reporting duty. What it requires

Show the other 2 laws

Vanuatu	Digital Transformation Act 2025, ICT service permit for AI and AI-related data services	Through its governance duty. What it requires
Vatican City	Guidelines on Artificial Intelligence of Vatican City State (Decree No. DCCII)	Through its governance duty. What it requires

Adult content age verification (AV)

9 laws, 8 places

Place	Law	How it reaches this control
Arizona	HB2112, internet pornography, minors, age verification	Through its retention duty. What it requires
Georgia	SB 351 (2024), commercial entity age verification for material harmful to minors	Through its retention duty. What it requires
Indiana	SB 17 (2024), age verification for adult oriented websites	Through its retention duty. What it requires
Montana	SB 544, Revise Internet Laws Related to Material Harmful to Minors	Through its retention duty. What it requires
North Carolina	HB 8, Pornography Age Verification Enforcement (PAVE) Act	Through its retention duty. What it requires
North Dakota	HB 1561, age verification for sexual material harmful to minors	Through its retention duty. What it requires
North Dakota	SB 2380, age verification for sexual material harmful to minors (companion to HB 1561)	Through its retention duty. What it requires
Oklahoma	SB 1959, age verification for material harmful to minors	Through its retention duty. What it requires
Tennessee	Protect Tennessee Minors Act (SB 1792/HB 1614, 2024 Tenn. Pub. Acts ch. 1021)	Through its retention duty. What it requires

AI sector rules

7 laws, 7 places

Place	Law	How it reaches this control
Alabama	SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization	Through its governance, reporting duties. What it requires
Colorado	Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models	Through its governance, reporting duties. What it requires
Georgia	Private Review Agent Artificial Intelligence Coverage Determinations Act (SB 444) from 1 Jan 2027, in 3 months	Through its governance duty. What it requires
Maine	Use of artificial intelligence in therapy or psychotherapy services from a date not yet set	Through its governance duty. What it requires
Minnesota	Utilization Review, AI-Only Adverse Determination Prohibition from 1 Jan 2027, in 3 months	Through its governance duty. What it requires
Nevada	AB 406 (2025), licensed provider restriction on direct clinical use of AI	Through its governance duty. What it requires
Utah	Health Insurance Preauthorization AI Disclosure (SB 319, 2026 General Session) from 1 Jan 2027, in 3 months	Through its governance duty. What it requires

AI transparency

6 laws, 6 places

Place	Law	How it reaches this control
California	Companion Chatbot Safety and Accountability Act (SB 243)	Through its reporting duty. What it requires
Colorado	HB 26-1263 (2026), Conversational AI Service Operator Requirements from 1 Jan 2027, in 3 months	Through its reporting duty. What it requires
Gabon	Ordonnance n°0011/PR/2026, marquage des contenus générés par intelligence artificielle	Through its reporting duty. What it requires
Illinois	Artificial Intelligence Video Interview Act	Through its reporting duty. What it requires
Jamaica	Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings	Through its governance duty. What it requires
Oregon	AI Companion Chatbot Safety Act (SB 1546) from a date not yet set	Through its reporting duty. What it requires

Sensitive categories

5 laws, 5 places

Place	Law	How it reaches this control
Gabon	Law No. 025/2023, sensitive categories of personal data and children's data	Through its governance duty. What it requires
Mexico	Ley Federal de Protección de Datos Personales en Posesión de los Particulares, sensitive personal data	Through its retention duty. What it requires
Paraguay	Ley N° 6534/2020, de Protección de Datos Personales Crediticios	Through its reporting duty. What it requires
Puerto Rico	Ley para la Protección de la Privacidad Cibernética de los Niños y Jóvenes (children's online privacy)	Through its retention duty. What it requires
Rwanda	Law relating to the Protection of Personal Data and Privacy, sensitive personal data and children's data	Through its retention duty. What it requires

Product security requirements

3 laws, 3 places

Place	Law	How it reaches this control
Australia	Security Standards for Smart Devices	Through its governance duty. What it requires
China	Cybersecurity Law, Network Product and Service Security Duties	Through its governance, reporting duties. What it requires
Finland	Kyberkestävyyslaki, National Enforcement and Market Surveillance for the Cyber Resilience Act	Through its reporting duty. What it requires

3 laws, 3 places

Place	Law	How it reaches this control
Florida	HB 3 (2024), social media use for minors	Through its retention duty. What it requires
Gabon	Ordonnance n°0011/PR/2026, protection des mineurs sur les réseaux sociaux	Through its reporting duty. What it requires
Greece	Law 4779/2021 Article 32, Video-Sharing Platform and Social Network Minor Protection Duties	Through its reporting duty. What it requires

AI prohibited practices

2 laws, 2 places

Place	Law	How it reaches this control
Denmark	Lov nr. 467 af 14. maj 2025, National Competent Authorities and Article 5 Enforcement	Through its governance duty. What it requires
Monaco	Code Pénal Arts. 294-3 to 294-4, Child Sexual Abuse Material Including Realistic and AI-Generated Depictions	Through its reporting duty. What it requires

Telephone contact

2 laws, 2 places

Place	Law	How it reaches this control
Germany	Gesetz gegen den unlauteren Wettbewerb, Documentation of Consent to Telephone Advertising	Through its reporting, retention duties. What it requires
United States	Telemarketing Sales Rule	Through its retention duty. What it requires

AI training data

1 law, 1 place

Place	Law	How it reaches this control
European Union	AI Act, Article 53 (obligations for providers of general-purpose AI models)	Through its governance duty. What it requires

Biometric privacy

1 law, 1 place

Place	Law	How it reaches this control
Illinois	Biometric Information Privacy Act (BIPA)	Through its retention duty. What it requires

Computer misuse

1 law, 1 place

Place	Law	How it reaches this control
Algeria	Loi n° 09-04 relative à la prévention et à la lutte contre les infractions liées aux technologies de l'information et de la communication	Through its reporting duty. What it requires

Cross border transfer

1 law, 1 place

Place	Law	How it reaches this control
Cuba	Resolución 58/2022 (MINCOM), security and localization rules for personal data in electronic form	Through its breach notice duty. What it requires

Data subject rights

1 law, 1 place

Place	Law	How it reaches this control
Ecuador	SPDP Norma General guaranteeing personal-data protection in the use of AI systems from a date not yet set	Through its governance duty. What it requires

FINOS AIGF AIR-DET-004AI System Observability

The same ground elsewhere linked through the kinds of duty both controls are mapped from

Comprehensive regime

Breach notification

Vulnerability and incident reporting

Enforcement supervision

Sector security regimes

Security baseline statutes

AI risk obligations

AI governance

Adult content age verification (AV)

AI sector rules

AI transparency

Sensitive categories

Product security requirements

AI prohibited practices

Telephone contact

AI training data

Biometric privacy

Computer misuse

Cross border transfer

Data subject rights

FINOS AIGF AIR-DET-004AI System Observability

The same ground elsewhere linked through the kinds of duty both controls are mapped from

Comprehensive regime

Breach notification

Vulnerability and incident reporting

Enforcement supervision

Sector security regimes

Security baseline statutes

AI risk obligations

AI governance

Adult content age verification (AV)

AI sector rules

AI transparency

Sensitive categories

Product security requirements

Social media and minors

AI prohibited practices

Telephone contact

AI training data

Biometric privacy

Computer misuse

Cross border transfer

Data subject rights