FINOS AIGF AIR-PREV-005, System Acceptance Testing: the laws that bear on it

AI prohibited practices

101 laws, 74 places

Place	Law	How it reaches this control
Alabama	Alabama Child Protection Act of 2024, AI-Generated Child Sexual Abuse Material	Through its prohibition duty. What it requires
Arizona	AI-generated and indistinguishable depictions included in child-exploitation definitions (HB 2678)	Through its prohibition duty. What it requires
Arizona	Unlawful disclosure extended to AI-generated 'realistic pictorial representation' intimate images (SB 1462)	Through its prohibition duty. What it requires
Arkansas	Act 159 of 2025 (HB 1071), AI-Generated Replicas Amendment to Publicity Rights Act	Through its prohibition duty. What it requires
Arkansas	Act 827 of 2025 (HB 1529), Unlawful Creation or Distribution of Deepfake Visual Material	Through its prohibition duty. What it requires
Arkansas	Act 977 of 2025 (HB 1877), AI-Generated Child Sexual Abuse Material Amendments	Through its prohibition duty. What it requires
Australia	Using a Carriage Service to Transmit Sexual Material Without Consent (Deepfake Offences)	Through its prohibition duty. What it requires
Austria	StGB Section 207a(4)(4), Computer-Generated and Altered Child Sexual Abuse Material	Through its prohibition duty. What it requires
Bahamas	Sexual Offences Act, child pornography offence	Through its prohibition duty. What it requires
Bangladesh	Cyber Security Act, 2026, AI-generated sexual content and CSAM ban	Through its prohibition duty. What it requires

Show the other 91 laws

Berkeley	Prohibition on the Sale or Use of Coordinated Pricing Algorithms	Through its prohibition duty. What it requires
Bermuda	Criminal Code Act 1907, making and distributing child abusive material or child pornography	Through its prohibition duty. What it requires
Bhutan	Information, Communications and Media Act of Bhutan 2018, obscene communications depicting children	Through its prohibition duty. What it requires
Brazil	TSE Resolution, Prohibition on Electoral Deepfakes	Through its prohibition duty. What it requires
Cabo Verde	Cybercrime Law, Child Pornography Including Simulated Representations	Through its prohibition duty. What it requires
Cayman Islands	Penal Code 2019 Revision, indecent photographs and pseudo-photographs of children	Through its prohibition duty. What it requires
Colombia	Código Penal, Falsedad Personal, AI Deepfake Aggravation	Through its prohibition duty. What it requires
Comoros	Penal Code, pornographic and manipulated image or representation offenses via an information system	Through its prohibition duty. What it requires
Czech Republic	Criminal Code Section 191a, Non-Consensual Identity-Based Pornographic Depiction	Through its prohibition duty. What it requires
Czech Republic	Criminal Code Section 192, Child Pornography Including a Depiction of a Person Who Appears to Be a Child	Through its prohibition duty. What it requires
Delaware	Child sexual abuse material offenses, computer-generated depictions	Through its prohibition duty. What it requires
Delaware	House Bill 191 (2026), medical professional title protection against nonhuman and AI entities	Through its prohibition duty. What it requires
Delaware	House Bill 353 (2024), deep fake intimate images (The Amelia Kramer Act)	Through its prohibition duty. What it requires
Denmark	Lov nr. 467 af 14. maj 2025, National Competent Authorities and Article 5 Enforcement	Through its governance, prohibition duties. What it requires
European Union	AI Act, Article 5 (prohibited AI practices)	Through its prohibition duty. What it requires
European Union	AI Act, Article 5(1)(ba) and (bb) (AI-generated non-consensual intimate imagery and child sexual abuse material) from 2 Dec 2026, in 8 weeks	Through its prohibition duty. What it requires
Finland	Rikoslaki Chapter 20, Distribution and Possession of an Image Depicting a Child Sexually, Including Realistic Depictions	Through its prohibition duty. What it requires
France	Code Pénal Article 226-8 as Amended, Existing Offense Extended to Algorithmically Generated Content	Through its prohibition duty. What it requires
France	Code Pénal Article 226-8-1, Non-Consensual Sexual Montage and Algorithmically Generated Sexual Content	Through its prohibition duty. What it requires
Gabon	Ordonnance n°0011/PR/2026, contenus interdits générés par intelligence artificielle	Through its prohibition duty. What it requires
Hoboken	Ord. No. B-781, Algorithmic Rent Fixing in Rental Housing Market Prohibited	Through its prohibition duty. What it requires
Hungary	Büntető Törvénykönyv (Criminal Code), Section 204(8), Realistic Depiction of a Non-Existent Person as Child Pornography	Through its prohibition duty. What it requires
Idaho	Disclosing explicit synthetic media	Through its prohibition duty. What it requires
Illinois	Child sexual abuse material, computer-generated and digitally altered depictions	Through its prohibition duty. What it requires
Illinois	Civil Remedies for Nonconsensual Dissemination of Private Sexual Images Act, digitally altered images	Through its prohibition duty. What it requires
Illinois	Right of Publicity Act, unauthorized AI digital replica prohibition	Through its prohibition duty. What it requires
Indiana	Child Exploitation and Possession of Child Pornography, obscene simulated or computer-generated images	Through its prohibition duty. What it requires
Indiana	Distribution of an Intimate Image and Civil Action for Nonconsensual Pornography, extended to AI-generated images (House Enrolled Act 1047, 2024)	Through its prohibition duty. What it requires
Iowa	Harassment, nonconsensual and synthetic intimate images	Through its prohibition duty. What it requires
Iowa	Sexual exploitation of a minor, AI-generated and manipulated depictions	Through its prohibition duty. What it requires
Jersey City	Ordinance 25-057, Preventing Algorithmic Rent-Fixing in the Rental Housing Market	Through its prohibition duty. What it requires
Jordan	Cybercrime Law, Ban on Real, Virtual, and Simulated Depictions of a Minor	Through its prohibition duty. What it requires
Kosovo	Criminal Code of the Republic of Kosovo, Articles 225 and 232 (Child Pornography, Including Computer-Generated and Non-Existent-Child Images)	Through its prohibition duty. What it requires
Latvia	Krimināllikums Sections 90.1 and 90.2, Criminalization of Deepfake Election and State-Appointment Disinformation	Through its prohibition duty. What it requires
Lithuania	Criminal Code Art. 309(2), Dealing in Child Sexual Abuse Material Including Simulated Depictions	Through its prohibition duty. What it requires
Maine	Unauthorized dissemination of certain private images (AI-generated image amendment)	Through its prohibition duty. What it requires
Mexico	Código Penal Federal, Violación a la Intimidad Sexual (Arts. 199 Octies a 199 Decies), including manipulated or non-corresponding depictions	Through its prohibition duty. What it requires
Michigan	Protection from Intimate Deep Fakes Act (Public Act 11 of 2025)	Through its prohibition duty. What it requires
Minneapolis	Prohibition on Use of Rent-Setting Algorithms (Ord. No. 2025-010)	Through its prohibition duty. What it requires
Mississippi	HB 1308 (2025), Morphed-Image Child Exploitation Amendments	Through its prohibition duty. What it requires
Monaco	Code Pénal Arts. 294-3 to 294-4, Child Sexual Abuse Material Including Realistic and AI-Generated Depictions	Through its prohibition duty. What it requires
Montana	Digital Likeness and Voice Rights Act (HB 513, 2025), unauthorized AI depiction liability	Through its prohibition duty. What it requires
Montana	Privacy in communications, digitally fabricated intimate images	Through its prohibition duty. What it requires
Montana	Sexual abuse of children, computer-generated child pornography	Through its prohibition duty. What it requires
Nebraska	Child Sexual Abuse Material Prevention Act, computer-generated and artificial-intelligence depictions	Through its prohibition duty. What it requires
Nevada	AB 406 (2025), AI mental and behavioral health care provider and marketing prohibitions	Through its prohibition duty. What it requires
Nevada	SB 213 (2025), AI-generated and digitally altered intimate images	Through its prohibition duty. What it requires
Nevada	SB 263 (2025), AI-generated and computer-generated child sexual abuse material	Through its prohibition duty. What it requires
New Jersey	Deceptive Audio or Visual Media (Deepfake) Criminalization Act	Through its prohibition duty. What it requires
New Mexico	Sexual Exploitation of Children Act, morphed and computer-generated image provisions	Through its prohibition duty. What it requires
North Carolina	AI-Generated Intimate Images and Child Sexual Abuse Material (Session Law 2024-37, HB 591)	Through its prohibition duty. What it requires
North Dakota	House Bill 1351 (2025), sexually expressive images including AI-generated or altered deepfakes	Through its prohibition duty. What it requires
North Dakota	House Bill 1429 (2025), harassment and stalking with a robot	Through its prohibition duty. What it requires
Ohio	S.B. 163, AI-Generated Child Sexual Abuse Material and Nonconsensual Replica Prohibitions proposed	Through its prohibition duty. What it requires
Oregon	Unlawful dissemination of an intimate image extended to AI-generated depictions (HB 2299)	Through its prohibition duty. What it requires
Pennsylvania	Act 125 of 2024, artificially generated child sexual abuse material	Through its prohibition duty. What it requires
Pennsylvania	Act 125 of 2024, artificially generated sexual depictions in the unlawful dissemination of intimate image offense	Through its prohibition duty. What it requires
Pennsylvania	Act 35 of 2025, digital forgery	Through its prohibition duty. What it requires
Peru	Reglamento de la Ley 31814, prohibited AI uses	Through its prohibition duty. What it requires
Philadelphia	Bill No. 240823, Anti-Competitive Rental Practices	Through its prohibition duty. What it requires
Poland	Kodeks karny art. 202 § 4b-4c, Fabricated Child Sexual Abuse Material	Through its prohibition duty. What it requires
Providence	Prohibition of Algorithmic Rent Setting Devices	Through its prohibition duty. What it requires
Rockville	Price Coordination and Algorithmic Devices from 1 Jan 2027, in 3 months	Through its prohibition duty. What it requires
Romania	Cod penal, Art. 374, Pornografia infantilă (Child Pornography, Including Simulated or Computer-Generated Depictions of Minors)	Through its prohibition duty. What it requires
Saint Kitts and Nevis	Electronic Crimes Act, child pornography, including computer-generated depictions	Through its prohibition duty. What it requires
Samoa	Crimes Act 2013, child pornography offence reaching synthetic and represented depictions	Through its prohibition duty. What it requires
San Diego	Prohibition of Anti-Competitive Automated Rent Price-Fixing Ordinance (Ord. O-21955 N.S.)	Through its prohibition duty. What it requires
San Francisco	Use and Sale of Algorithmic Devices Prohibited (Rent Ordinance Sec. 37.10C), as amended by Ord. No. 169-25	Through its prohibition duty. What it requires
Santa Monica	Algorithmic Rental Price Fixing (Ord. No. 2817 (CCS))	Through its prohibition duty. What it requires
Seattle	Ordinance 127241 (Council Bill 121000), Algorithmic Rent Fixing	Through its prohibition duty. What it requires
Slovenia	Kazenski zakonik (KZ-1, Criminal Code), Art. 176(3), Pornographic Material Involving a Minor's Realistic Likeness	Through its prohibition duty. What it requires
South Carolina	AI-Generated and Morphed Images of an Identifiable Minor (2025 Act No. 58, S.29)	Through its prohibition duty. What it requires
Sweden	Brottsbalken 16 kap. 10 a-10 b §§, Child Pornography Offence (Barnpornografibrott)	Through its prohibition duty. What it requires
Tennessee	AI-generated child sexual abuse material, tool possession and distribution offense	Through its prohibition duty. What it requires
Tennessee	Ensuring Likeness, Voice, and Image Security (ELVIS) Act	Through its prohibition duty. What it requires
Tennessee	Preventing Deepfake Images Act	Through its prohibition duty. What it requires
Texas	Political deep fake video ban (originally S.B. 751, 2019)	Through its prohibition duty. What it requires
Texas	S.B. 20 (2025), possession, promotion, or production of AI-generated or apparent child pornography	Through its prohibition duty. What it requires
Texas	S.B. 441 (2025), unlawful production or distribution of AI deep fake sexually explicit media	Through its prohibition duty. What it requires
Texas	TRAIGA (H.B. 149, 2025), prohibited AI practices binding any person	Through its prohibition duty. What it requires
Timor-Leste	Penal Code, Article 176 (Child Pornography)	Through its prohibition duty. What it requires
Turkey	Commercial Advertising Regulation, AI Deepfake Endorsement Ban	Through its prohibition duty. What it requires
Utah	Digital Voyeurism Prevention Act (HB 276, 2026 General Session), Utah Code Title 13 Chapter 72b from 1 Jan 2027, in 3 months	Through its prohibition duty. What it requires
Utah	Identity Protection Modifications, AI Defamation and Identity Replication (SB 256, 2026 General Session)	Through its prohibition duty. What it requires
Vatican City	Child sexual abuse material offences (Legge N. VIII, arts. 4, 10-11)	Through its prohibition duty. What it requires
Vermont	Disclosure of sexually explicit images without consent, digitized and computer-generated images	Through its prohibition duty. What it requires
West Virginia	SB 198 (2025), computer-generated child pornography prohibition	Through its prohibition duty. What it requires
West Virginia	SB 198 (2025), fabricated intimate image disclosure prohibition	Through its prohibition duty. What it requires
Wisconsin	2023 Wisconsin Act 224, Possession of Virtual Child Pornography	Through its prohibition duty. What it requires
Wisconsin	2025 Wisconsin Act 34, Synthetic Intimate Representation Ban	Through its prohibition duty. What it requires
Wyoming	Artificial Intelligence Offenses (2026 Wyoming House Bill 102, Enrolled Act No. 32)	Through its prohibition duty. What it requires

Comprehensive regime

75 laws, 73 places

Place	Law	How it reaches this control
Albania	Law No. 124/2024 On the Protection of Personal Data	Through its DPIA, governance duties. What it requires
Algeria	Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11	Through its DPIA, governance duties. What it requires
Andorra	LQPD, Llei 29/2021 del 28 d'octubre	Through its DPIA, governance duties. What it requires
Argentina	Ley 25.326, Ley de Protección de los Datos Personales	Through its governance duty. What it requires
Barbados	Data Protection Act, 2019	Through its DPIA, governance duties. What it requires
Belarus	Law of the Republic of Belarus On Personal Data Protection	Through its governance duty. What it requires
Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel)	Through its DPIA, governance duties. What it requires
Bosnia and Herzegovina	Law on the Protection of Personal Data of Bosnia and Herzegovina	Through its DPIA, governance duties. What it requires
Botswana	Data Protection Act, 2024 (Act No. 18 of 2024)	Through its DPIA, governance duties. What it requires
Brazil	Lei Geral de Proteção de Dados Pessoais (LGPD)	Through its governance duty. What it requires

Show the other 65 laws

Burkina Faso	Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel	Through its governance duty. What it requires
Cambodia	Draft Law on Personal Data Protection, final draft proposed	Through its DPIA, governance duties. What it requires
Cameroon	Loi n°2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun from a date not yet set	Through its governance duty. What it requires
Central African Republic	Loi n° 24.001 portant protection des données à caractère personnel	Through its governance duty. What it requires
Colombia	Ley 1581 de 2012, General Personal Data Protection	Through its governance duty. What it requires
Colombia	Superintendencia Circular on AI and Personal Data	Through its DPIA duty. What it requires
Comoros	Law on the Protection of Personal Data	Through its governance duty. What it requires
Côte d'Ivoire	Law No. 2013-450 on the Protection of Personal Data	Through its governance duty. What it requires
Democratic Republic of the Congo	Digital Code, Title III: Personal Data Protection	Through its DPIA, governance duties. What it requires
Djibouti	Digital Code, Book I: Personal Data Protection and CNDP	Through its governance duty. What it requires
Dominican Republic	Ley No. 172-13 sobre Protección Integral de los Datos Personales	Through its governance duty. What it requires
Ecuador	LOPDP, comprehensive personal-data protection regime	Through its DPIA, governance duties. What it requires
Egypt	Law No. 151 of 2020 Promulgating the Personal Data Protection Law	Through its governance duty. What it requires
El Salvador	Ley para la Protección de Datos Personales	Through its governance duty. What it requires
Eswatini	Data Protection Act, 2022 (Act No. 5 of 2022)	Through its governance duty. What it requires
Ethiopia	Personal Data Protection Proclamation	Through its DPIA, governance duties. What it requires
European Union	General Data Protection Regulation (GDPR), Comprehensive Regime	Through its governance duty. What it requires
Gabon	Loi n°001/2011 relative à la protection des données à caractère personnel, modifiée par la loi n°025/2023	Through its governance duty. What it requires
Gambia	Personal Data Protection and Privacy Act, 2025 from a date not yet set	Through its DPIA, governance duties. What it requires
Grenada	Data Protection Act, No. 1 of 2023 from a date not yet set	Through its governance duty. What it requires
Ireland	DPC Guidance: AI, Large Language Models and Data Protection	Through its DPIA duty. What it requires
Jamaica	Data Protection Act, 2020, registration, lawful basis and standards for processing	Through its DPIA, governance duties. What it requires
Kiribati	Data Protection Act 2025 from a date not yet set	Through its DPIA duty. What it requires
Kosovo	Law No. 06/L-082 on Protection of Personal Data	Through its DPIA, governance duties. What it requires
Lebanon	Law No. 81/2018 on Electronic Transactions and Personal Data, Part V (Personal Data Protection)	Through its governance duty. What it requires
Lesotho	Data Protection Act, 2011 (Act No. 5 of 2012)	Through its governance duty. What it requires
Liberia	Telecommunications Act of 2007, Protection of Personal Information (§§ 51-52)	Through its governance duty. What it requires
Madagascar	Law No. 2014-038, protection of personal data	Through its governance duty. What it requires
Maldives	Personal Data Protection Bill, pending before the People's Majlis proposed	Through its governance duty. What it requires
Mali	Loi n° 2013-015, protection des données à caractère personnel	Through its governance duty. What it requires
Marshall Islands	Personal Data Protection Act 2025, government personal-data protection principles	Through its governance duty. What it requires
Mauritania	Loi n° 2017-020, protection des données à caractère personnel	Through its governance duty. What it requires
Mexico	Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP)	Through its governance duty. What it requires
Moldova	Law No. 195/2024 on Personal Data Protection	Through its DPIA, governance duties. What it requires
Monaco	Loi sur la Protection des Données Personnelles	Through its DPIA, governance duties. What it requires
Montenegro	Law on Personal Data Protection from a date not yet set	Through its governance duty. What it requires
Morocco	Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data	Through its governance duty. What it requires
Mozambique	Electronic Transactions Law, Protection of Personal Electronic Data	Through its governance duty. What it requires
Nicaragua	Ley No. 787, Ley de Protección de Datos Personales	Through its governance duty. What it requires
Niger	Loi n° 2022-59, protection des données à caractère personnel	Through its DPIA, governance duties. What it requires
Nigeria	Nigeria Data Protection Act, 2023 (NDPA), general data protection duties	Through its DPIA, governance duties. What it requires
North Macedonia	Law on Personal Data Protection (LPDP)	Through its governance duty. What it requires
Panama	Ley 81 de 2019, Sobre Protección de Datos Personales	Through its governance duty. What it requires
Paraguay	Ley N° 7593/2025, de Protección de Datos Personales en la República del Paraguay from 27 Nov 2027, in 14 months	Through its DPIA, governance duties. What it requires
Peru	Ley 29733, Ley de Protección de Datos Personales	Through its governance duty. What it requires
Republic of the Congo	Law No. 29-2019 on the Protection of Personal Data	Through its DPIA, governance duties. What it requires
Rwanda	Law relating to the Protection of Personal Data and Privacy	Through its DPIA, governance duties. What it requires
San Marino	San Marino Law No. 171 on the Protection of Natural Persons	Through its DPIA, governance duties. What it requires
Sao Tome and Principe	Lei n.º 03/2016, Protecção de Dados Pessoais	Through its governance duty. What it requires
Senegal	Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel (Personal Data Protection Act)	Through its governance duty. What it requires
Serbia	Law on Personal Data Protection	Through its DPIA, governance duties. What it requires
Somalia	Data Protection Act No. 005 of 2023	Through its DPIA, governance duties. What it requires
South Africa	Protection of Personal Information Act 4 of 2013 (POPIA)	Through its governance duty. What it requires
Suriname	Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens) proposed	Through its governance duty. What it requires
Syria	Law No. 12 of 2024 on Protection of Electronic Personal Data	Through its governance duty. What it requires
Togo	Loi n° 2019-014, protection des données à caractère personnel	Through its governance duty. What it requires
Trinidad and Tobago	Data Protection Act, 2011	Through its governance duty. What it requires
Tunisia	Organic Act on the Protection of Personal Data	Through its governance duty. What it requires
Uganda	Data Protection and Privacy Act, 2019, comprehensive personal-data regime	Through its governance duty. What it requires
Ukraine	Draft Law No. 8153 on Personal Data Protection (GDPR-Aligned Reform) proposed	Through its DPIA, governance duties. What it requires
Ukraine	Law of Ukraine On the Protection of Personal Data	Through its governance duty. What it requires
Uruguay	Ley N° 18.331, Personal Data Protection and Habeas Data Law, as amended	Through its DPIA, governance duties. What it requires
Vatican City	General Regulation on the Protection of Personal Data for Vatican City State	Through its governance duty. What it requires
Zambia	Data Protection Act, 2021, personal data processing framework	Through its DPIA, governance duties. What it requires
Zimbabwe	Cyber and Data Protection Act [Chapter 12:07]	Through its governance duty. What it requires

Enforcement supervision

69 laws, 68 places

Place	Law	How it reaches this control
Albania	Law No. 124/2024, Commissioner, remedies, liability and penalties	Through its governance duty. What it requires
Algeria	Loi n° 18-07 relative à la protection des personnes physiques, contrôle, sanctions et voies de recours	Through its governance duty. What it requires
Andorra	LQPD, the Andorran Data Protection Agency, its powers, infractions and sanctions	Through its governance duty. What it requires
Angola	Law on the Protection of Personal Data, enforcement and supervision	Through its governance duty. What it requires
Antigua and Barbuda	Data Protection Act, 2013, information commissioner and enforcement	Through its governance duty. What it requires
Argentina	Ley 25.326, enforcement, sanctions, and the habeas data action	Through its governance duty. What it requires
Bahamas	Data Protection Act 2003, Commissioner, enforcement and penalties	Through its governance duty. What it requires
Barbados	Data Protection Act, 2019, the Commissioner, enforcement and penalties	Through its governance duty. What it requires
Belarus	Law of the Republic of Belarus On Personal Data Protection, authorized agency and liability	Through its governance duty. What it requires
Belize	Data Protection Act 2021, Commissioner, Tribunal, and enforcement from a date not yet set	Through its governance duty. What it requires

Show the other 59 laws

Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, Autorité de Protection des Données Personnelles, sanctions et infractions pénales	Through its governance duty. What it requires
Bermuda	Personal Information Protection Act 2016, Commissioner, enforcement and offences	Through its governance duty. What it requires
Bosnia and Herzegovina	Law on the Protection of Personal Data of Bosnia and Herzegovina, the Agency, enforcement and penalties	Through its governance duty. What it requires
Brazil	LGPD, civil liability, administrative sanctions and the ANPD	Through its governance duty. What it requires
Burkina Faso	Personal Data Protection Law, supervisory authority and sanctions	Through its governance duty. What it requires
Cabo Verde	Law No. 133/V/2001 on the Protection of Personal Data, enforcement and supervision	Through its governance duty. What it requires
Cayman Islands	Data Protection Act 2021 Revision, Ombudsman enforcement, monetary penalties and offences	Through its governance duty. What it requires
Chad	Loi n°007/PR/2015, sanctions administratives et pénales et recours	Through its governance duty. What it requires
China	Personal Information Protection Law, Supervision and Legal Liability	Through its governance duty. What it requires
Colombia	SIC Circular on AI, Demonstrated Accountability	Through its governance duty. What it requires
Comoros	Law on the Protection of Personal Data, the Commission and sanctions	Through its governance duty. What it requires
Costa Rica	Código Penal, artículo 196 bis, Violación de datos personales	Through its prohibition duty. What it requires
Côte d'Ivoire	Law No. 2013-450 on the Protection of Personal Data, enforcement and the Protection Body	Through its governance duty. What it requires
Democratic Republic of the Congo	Digital Code, Data Protection Authority and sanctions	Through its governance duty. What it requires
Djibouti	Digital Code, Book I: the Commission, administrative sanctions and criminal offences	Through its governance duty. What it requires
Egypt	Egypt Personal Data Protection Law, the Center, judicial control and penalties	Through its governance duty. What it requires
El Salvador	Ley para la Protección de Datos Personales, enforcement and sanctions	Through its prohibition duty. What it requires
Eritrea	Penal Code of the State of Eritrea, Violation of Privacy from a date not yet set	Through its prohibition duty. What it requires
Eswatini	Data Protection Act, 2022, enforcement and offences	Through its governance duty. What it requires
Ethiopia	Personal Data Protection Proclamation, enforcement, sanctions and offences	Through its governance duty. What it requires
Gabon	Law No. 025/2023, recourse, oversight and sanctions	Through its governance duty. What it requires
Gambia	Personal Data Protection and Privacy Act, 2025, the Information Commission, offences and penalties from a date not yet set	Through its governance, prohibition duties. What it requires
Ghana	Data Protection Act, enforcement, offences and penalties	Through its governance, prohibition duties. What it requires
Grenada	Data Protection Act, No. 1 of 2023, Information Commission, enforcement and offences from a date not yet set	Through its governance duty. What it requires
Idaho	Student Data Accessibility, Transparency and Accountability Act (SDATAA) from a date not yet set	Through its governance duty. What it requires
Jamaica	Data Protection Act, 2020, the Information Commissioner, penalties and compensation	Through its prohibition duty. What it requires
Kiribati	Data Protection Act 2025, enforcement, offences and civil remedies from a date not yet set	Through its governance duty. What it requires
Kosovo	Law No. 06/L-082 on Protection of Personal Data, remedies, the Agency, inspections and penalties	Through its governance duty. What it requires
Lesotho	Data Protection Act, 2011, enforcement and offences	Through its governance duty. What it requires
Libya	Law No. 6 of 2022, supervisory authority, licensing and penalties	Through its governance duty. What it requires
Madagascar	Law No. 2014-038, CMIL, sanctions and offences	Through its governance duty. What it requires
Mali	Loi n° 2013-015, the Autorité, supervision, and sanctions	Through its governance duty. What it requires
Marshall Islands	Criminal Code 2011, Violation of Privacy (unlawful eavesdropping, surveillance, and breach of privacy of messages)	Through its prohibition duty. What it requires
Marshall Islands	Personal Data Protection Act 2025, competent authority, remedies, and complaints	Through its governance duty. What it requires
Mauritania	Loi n° 2017-020, Autorité de Protection des Données et sanctions	Through its governance duty. What it requires
Moldova	Moldova Law No. 195/2024, the Centre, complaints, compensation and sanctions	Through its governance duty. What it requires
Monaco	Loi sur la Protection des Données Personnelles, autorité de contrôle et sanctions	Through its governance duty. What it requires
Montenegro	Law on Personal Data Protection, agency, supervision and penal provisions from a date not yet set	Through its governance duty. What it requires
Morocco	Law No. 09-08, the CNDP and sanctions	Through its governance duty. What it requires
Nicaragua	Ley No. 787, Ley de Protección de Datos Personales, supervision, sanctions, and complaints	Through its governance duty. What it requires
Niger	Loi n° 2022-59, contrôle, sanctions et recours	Through its governance duty. What it requires
Nigeria	Nigeria Data Protection Act, 2023, complaints, enforcement and redress	Through its governance duty. What it requires
North Macedonia	Law on Personal Data Protection (LPDP), the Agency, supervision and misdemeanour provisions	Through its governance duty. What it requires
Panama	Ley 81 de 2019, enforcement and sanctions	Through its governance duty. What it requires
Peru	Ley 29733, enforcement, supervisory authority and sanctions	Through its governance duty. What it requires
Rwanda	Law relating to the Protection of Personal Data and Privacy, supervisory authority, penalties and offences	Through its governance duty. What it requires
Saint Kitts and Nevis	Data Protection Act, 2018, Information Commissioner, enforcement and offences from a date not yet set	Through its governance, prohibition duties. What it requires
San Marino	San Marino Law No. 171, the Data Protection Authority, remedies and fines	Through its governance, prohibition duties. What it requires
Senegal	Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel, Commission des Données Personnelles et sanctions	Through its governance duty. What it requires
Somalia	Data Protection Act, 2023, complaints, orders of the Authority and civil remedies	Through its governance duty. What it requires
South Africa	Protection of Personal Information Act, the Information Regulator, enforcement and penalties	Through its governance duty. What it requires
Suriname	Draft Law on the Protection of Privacy and Personal Data, Commissioner, remedies and fines proposed	Through its governance duty. What it requires
Syria	Law No. 12 of 2024 on Protection of Electronic Personal Data, Authority, complaints and penalties	Through its governance duty. What it requires
Togo	Loi n° 2019-014, cadre institutionnel et dispositions pénales	Through its governance duty. What it requires
Tonga	Privacy Act 2025, penalties, enforcement and third party actions from a date not yet set	Through its governance duty. What it requires
Trinidad and Tobago	Data Protection Act, 2011, Commissioner, contravention and enforcement	Through its governance duty. What it requires
Tunisia	Organic Act on the Protection of Personal Data, enforcement and sanctions	Through its governance duty. What it requires
Vanuatu	Data Protection and Privacy Act 2024, enforcement powers and offences	Through its governance duty. What it requires
Zimbabwe	Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024	Through its governance duty. What it requires

Sensitive categories

67 laws, 66 places

Place	Law	How it reaches this control
Albania	Law No. 124/2024, special categories of personal data, criminal records and children's data	Through its prohibition duty. What it requires
Algeria	Loi n° 18-07 relative à la protection des personnes physiques, catégories de données sensibles et biométriques	Through its prohibition duty. What it requires
Andorra	LQPD, special categories, children and criminal-offence data	Through its prohibition duty. What it requires
Angola	Law on the Protection of Personal Data, sensitive data categories	Through its prohibition duty. What it requires
Antigua and Barbuda	Data Protection Act, 2013, sensitive personal data	Through its prohibition duty. What it requires
Argentina	Ley 25.326, sensitive data categories and health data	Through its prohibition duty. What it requires
Barbados	Data Protection Act, 2019, a child's consent and sensitive personal data	Through its prohibition duty. What it requires
Belarus	Law of the Republic of Belarus On Personal Data Protection, special personal data	Through its prohibition duty. What it requires
Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, données sensibles et mineurs	Through its prohibition duty. What it requires
Bosnia and Herzegovina	Law on the Protection of Personal Data of Bosnia and Herzegovina, special categories, criminal-conviction data and children's consent	Through its prohibition duty. What it requires

Show the other 57 laws

Brazil	LGPD, sensitive personal data and children's data	Through its prohibition duty. What it requires
Burkina Faso	Personal Data Protection Law, sensitive personal data categories	Through its prohibition duty. What it requires
Cabo Verde	Law No. 133/V/2001 on the Protection of Personal Data, sensitive data categories	Through its prohibition duty. What it requires
Cambodia	Cambodia's Draft Law on Personal Data Protection, sensitive personal data proposed	Through its prohibition duty. What it requires
Central African Republic	Loi n° 24.001 portant protection des données à caractère personnel, données sensibles et mineurs	Through its prohibition duty. What it requires
Colombia	Ley 1581 de 2012, Sensitive Categories and Children's Data	Through its prohibition duty. What it requires
Comoros	Law on the Protection of Personal Data, sensitive personal data	Through its prohibition duty. What it requires
Côte d'Ivoire	Law No. 2013-450 on the Protection of Personal Data, sensitive categories of personal data	Through its prohibition duty. What it requires
Democratic Republic of the Congo	Digital Code, Title III, sensitive personal data and minors	Through its prohibition duty. What it requires
Djibouti	Digital Code, Book I: sensitive categories of personal data and the minor's consent	Through its prohibition duty. What it requires
Dominican Republic	Ley No. 172-13 sobre Protección Integral de los Datos Personales, special and sensitive categories of data	Through its prohibition duty. What it requires
Ecuador	LOPDP, categorías especiales de datos personales	Through its prohibition duty. What it requires
Egypt	Egypt Personal Data Protection Law, Sensitive Personal Data and a child's data	Through its prohibition duty. What it requires
El Salvador	Ley para la Protección de Datos Personales, sensitive personal data and children	Through its prohibition duty. What it requires
Eswatini	Data Protection Act, 2022, sensitive personal information	Through its prohibition duty. What it requires
Ethiopia	Personal Data Protection Proclamation, sensitive personal data and minors	Through its prohibition duty. What it requires
Gabon	Law No. 025/2023, sensitive categories of personal data and children's data	Through its governance, prohibition duties. What it requires
Ghana	Data Protection Act, special personal data	Through its prohibition duty. What it requires
Grenada	Data Protection Act, No. 1 of 2023, sensitive personal data from a date not yet set	Through its prohibition duty. What it requires
Guam	Guam Uniform Civil Remedies for Unauthorized Disclosure of Intimate Images Act of 2019	Through its prohibition duty. What it requires
Kosovo	Law No. 06/L-082 on Protection of Personal Data, special categories, children and criminal-offence data	Through its prohibition duty. What it requires
Lebanon	Law No. 81/2018, Part V, health, genetic identity and sexual-life data	Through its prohibition duty. What it requires
Lesotho	Data Protection Act, 2011, sensitive personal information	Through its prohibition duty. What it requires
Madagascar	Law No. 2014-038, sensitive personal data	Through its prohibition duty. What it requires
Maldives	Maldives Personal Data Protection Bill, special categories of personal data proposed	Through its prohibition duty. What it requires
Mali	Loi n° 2013-015, sensitive data and offence records	Through its prohibition duty. What it requires
Mauritania	Loi n° 2017-020, catégories sensibles de données	Through its prohibition duty. What it requires
Moldova	Moldova Law No. 195/2024, special categories, a child's consent and conviction data	Through its prohibition duty. What it requires
Monaco	Loi sur la Protection des Données Personnelles, données sensibles et mineurs	Through its prohibition duty. What it requires
Montenegro	Law on Personal Data Protection, special categories of data from a date not yet set	Through its prohibition duty. What it requires
Morocco	Law No. 09-08, sensitive personal data and offense records	Through its prohibition duty. What it requires
New Mexico	Genetic Information Privacy Act from a date not yet set	Through its prohibition duty. What it requires
Nicaragua	Ley No. 787, Ley de Protección de Datos Personales, sensitive categories of data	Through its prohibition duty. What it requires
Niger	Loi n° 2022-59, données sensibles, de santé et biométriques	Through its prohibition duty. What it requires
Nigeria	Nigeria Data Protection Act, 2023, sensitive personal data and a child's data	Through its DPIA, prohibition duties. What it requires
North Macedonia	Law on Personal Data Protection (LPDP), special categories, a child's consent and biometric, health and genetic data	Through its prohibition duty. What it requires
Panama	Ley 81 de 2019, sensitive personal data	Through its prohibition duty. What it requires
Paraguay	Ley N° 7593/2025, tratamiento de datos sensibles y categorías especiales from 27 Nov 2027, in 14 months	Through its prohibition duty. What it requires
Republic of the Congo	Law No. 29-2019, special categories of personal data	Through its prohibition duty. What it requires
Saint Kitts and Nevis	Data Protection Act, 2018, processing of sensitive personal data from a date not yet set	Through its prohibition duty. What it requires
Saint Lucia	Data Protection Act, sensitive personal data	Through its prohibition duty. What it requires
San Marino	San Marino Law No. 171, special categories of personal data	Through its prohibition duty. What it requires
Senegal	Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel, catégories sensibles de données	Through its prohibition duty. What it requires
Serbia	Law on Personal Data Protection, special categories of personal data and minors	Through its prohibition duty. What it requires
South Africa	Protection of Personal Information Act, special personal information and children	Through its prohibition duty. What it requires
Suriname	Draft Law on the Protection of Privacy and Personal Data, special categories, children and criminal data proposed	Through its prohibition duty. What it requires
Syria	Law No. 12 of 2024 on Protection of Electronic Personal Data, sensitive personal data	Through its prohibition duty. What it requires
Timor-Leste	Constitution of Timor-Leste, Section 38(3) (Sensitive categories of personal data)	Through its prohibition duty. What it requires
Togo	Loi n° 2019-014, données sensibles	Through its prohibition duty. What it requires
Trinidad and Tobago	Data Protection Act, 2011, sensitive personal information	Through its prohibition duty. What it requires
Tunisia	Organic Act on the Protection of Personal Data, sensitive categories and minors	Through its prohibition duty. What it requires
Uganda	Data Protection and Privacy Act, 2019, children and special personal data	Through its prohibition duty. What it requires
Uruguay	Ley N° 18.331, sensitive personal data and health data	Through its prohibition duty. What it requires
Washington	HB 1155, My Health My Data Act	Through its prohibition duty. What it requires
Zambia	Data Protection Act, 2021, sensitive personal data, children and vulnerable persons	Through its prohibition duty. What it requires
Zimbabwe	Cyber and Data Protection Act, sensitive, genetic, biometric and health data	Through its prohibition duty. What it requires
Zimbabwe	Cyber and Data Protection Regulations 2024, children's information and automated decisions	Through its DPIA, prohibition duties. What it requires

Telephone contact

42 laws, 20 places

Place	Law	How it reaches this control
Australia	Do Not Call Register Act 2006, Unsolicited Marketing Faxes	Through its prohibition duty. What it requires
Australia	Do Not Call Register Act 2006, Unsolicited Telemarketing Calls	Through its prohibition duty. What it requires
California	Unsolicited Advertisements by Facsimile Machine	Through its prohibition duty. What it requires
California	Unsolicited and Unwanted Telephone Solicitations Act	Through its prohibition duty. What it requires
Canada	Telecommunications Act, Unsolicited Telecommunications and the National Do Not Call List	Through its prohibition duty. What it requires
Connecticut	Connecticut Action for Unsolicited Facsimile or Automated Telephone Advertising Messages	Through its prohibition duty. What it requires
Connecticut	Connecticut Telemarketing Act (Conn. Gen. Stat. 42-284 to 42-289, as substantially rewritten by Public Act 23-98)	Through its prohibition duty. What it requires
Delaware	Delaware Harassment Statute (Telephone Solicitation Clause)	Through its prohibition duty. What it requires
Delaware	Delaware Telemarketing Fraud Act	Through its prohibition duty. What it requires
Germany	Gesetz gegen den unlauteren Wettbewerb, Telephone Advertising Consent	Through its prohibition duty. What it requires

Show the other 32 laws

Illinois	Illinois Automatic Telephone Dialers Act	Through its prohibition duty. What it requires
Illinois	Illinois Telephone Solicitations Act	Through its prohibition duty. What it requires
Maryland	Maryland prerecorded-message dialing and caller number blocking rules	Through its prohibition duty. What it requires
Maryland	Maryland Stop the Spam Calls Act of 2023	Through its prohibition duty. What it requires
Massachusetts	Automatic Telephone Dialing Systems and Telephone Solicitation Disclosures	Through its prohibition duty. What it requires
Massachusetts	Telemarketing Solicitation Act	Through its prohibition duty. What it requires
Michigan	Home Solicitation Sales Act, Telephone Solicitation Rules (as amended effective 2003)	Through its prohibition duty. What it requires
Michigan	Telephone Companies as Common Carriers Act, Recorded Commercial Advertising and Caller Identification (section 25 as amended effective 1999)	Through its prohibition duty. What it requires
Montana	Montana Telemarketing Registration and Fraud Prevention Act	Through its prohibition duty. What it requires
Montana	Telephone Solicitation No-Call List Act	Through its prohibition duty. What it requires
Montana	Unlawful Automated Telephone Solicitation	Through its prohibition duty. What it requires
Montana	Unsolicited Advertisement Facsimile Transmissions	Through its prohibition duty. What it requires
Nevada	Nevada Deceptive Trade Practice Rules for Telephone and Text Solicitations	Through its prohibition duty. What it requires
Nevada	Nevada Device for Automatic Dialing and Announcing Statute	Through its prohibition duty. What it requires
Nevada	Nevada Telephone Solicitation Registry (Do Not Call List)	Through its prohibition duty. What it requires
New Hampshire	New Hampshire Telemarketing Sales Calls Act	Through its prohibition duty. What it requires
Oklahoma	Telemarketer Restriction Act, no-call registry	Through its prohibition duty. What it requires
Oklahoma	Telephone Solicitation Act of 2022	Through its prohibition duty. What it requires
Oregon	Oregon Automatic Dialing and Announcing Device Statute (as amended by 2025 Or. Laws ch. 580, effective January 1, 2026)	Through its prohibition duty. What it requires
Oregon	Oregon Telephone Solicitation Do Not Call List	Through its prohibition duty. What it requires
Oregon	Oregon Unlawful Telephone Solicitations Act (as amended by 2025 Or. Laws ch. 580, effective January 1, 2026)	Through its prohibition duty. What it requires
Pennsylvania	Telemarketer Registration Act	Through its prohibition duty. What it requires
Texas	Automatic Dial Announcing Devices	Through its prohibition duty. What it requires
Texas	Prohibited Telephonic and Facsimile Communications for Solicitation	Through its prohibition duty. What it requires
Texas	Texas No-Call List, Facsimile Solicitation Notice, and Caller Identification Rules	Through its prohibition duty. What it requires
United States	Telemarketing Sales Rule	Through its prohibition duty. What it requires
United States	Telephone Consumer Protection Act, National Do Not Call Registry and Company-Specific List	Through its prohibition duty. What it requires
Virginia	Virginia Automatic Dialing-Announcing Devices Act	Through its prohibition duty. What it requires
Virginia	Virginia Telephone Privacy Protection Act	Through its prohibition duty. What it requires
Washington	Automatic Dialing and Announcing Device Act	Through its prohibition duty. What it requires
Washington	Telephone Solicitation Act	Through its prohibition duty. What it requires
Washington	Unsolicited Telefacsimile Messages Act	Through its prohibition duty. What it requires

Sector security regimes

40 laws, 38 places

Place	Law	How it reaches this control
Albania	Law No. 25/2024, On Cybersecurity	Through its governance duty. What it requires
Andorra	Llei 22/2022, Cybersecurity Risk-Management Obligations	Through its governance duty. What it requires
Austria	Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures	Through its governance duty. What it requires
Belgium	Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance	Through its governance duty. What it requires
Bulgaria	Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS)	Through its governance duty. What it requires
Croatia	Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance	Through its governance duty. What it requires
Cyprus	Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance	Through its governance duty. What it requires
Czech Republic	Cybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures	Through its governance duty. What it requires
Denmark	NIS 2-loven, Cybersecurity Risk-Management Measures and Registration	Through its governance duty. What it requires
Estonia	Küberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties	Through its governance duty. What it requires

Show the other 30 laws

Ethiopia	Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations from 21 Jul 2027, in 9 months	Through its governance duty. What it requires
European Union	NIS2 Directive, Cybersecurity Risk-Management Measures	Through its governance duty. What it requires
Finland	Kyberturvallisuuslaki, Cybersecurity Risk-Management Measures and Governance	Through its governance duty. What it requires
Germany	BSI-Gesetz (BSIG), Risk-Management Measures for Essential and Important Entities	Through its governance duty. What it requires
Greece	Law 5160/2024, Cybersecurity Risk-Management Measures and Governance	Through its governance duty. What it requires
Haiti	BRH Circulaire 126, Information Security Rules for Financial Institutions	Through its governance duty. What it requires
Hungary	Cybersecurity Act, Risk-Management Measures	Through its governance duty. What it requires
Iceland	Minimum Risk-Management and Preparedness Requirements for Critical Infrastructure	Through its governance duty. What it requires
Italy	Decreto Legislativo 4 settembre 2024, n. 138 (Decreto NIS2), Risk-Management Measures	Through its governance duty. What it requires
Kiribati	Cybersecurity Act 2026, Critical Infrastructure Operator Obligations from a date not yet set	Through its governance duty. What it requires
Liechtenstein	Cyber-Sicherheitsgesetz (CSG), Risk-Management Measures for Essential and Important Entities	Through its governance duty. What it requires
Lithuania	Kibernetinio saugumo įstatymas (Law on Cyber Security), Risk-Management Measures	Through its governance duty. What it requires
Luxembourg	Loi du 5 mai 2026 relative à la cybersécurité (NIS2), Risk-Management Measures for Essential and Important Entities	Through its governance duty. What it requires
Malta	Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, Risk-Management Measures for Essential and Important Entities	Through its governance duty. What it requires
Marshall Islands	Cybersecurity Act 2025, Cybersecurity of Critical Information Infrastructure	Through its governance duty. What it requires
Montenegro	Law on Information Security, Essential and Important Entities	Through its DPIA, governance duties. What it requires
Mozambique	Cybersecurity Law, Sector-Specific Security Requirements for Critical Infrastructure, Essential Services and Digital Providers	Through its governance duty. What it requires
Netherlands	Cyberbeveiligingswet, Cybersecurity Risk-Management Measures and Governance	Through its governance duty. What it requires
Portugal	Regime Jurídico da Cibersegurança, Cybersecurity Risk-Management Measures and Governance	Through its governance duty. What it requires
Romania	Ordonanța de urgență nr. 155/2024, Cybersecurity Risk-Management Measures	Through its governance duty. What it requires
Serbia	Law on Information Security, ICT Systems of Special Importance and Security Measures	Through its governance duty. What it requires
Sierra Leone	Cyber Security and Crime Act, 2021, Critical National Information Infrastructure	Through its governance duty. What it requires
Slovakia	Zákon o kybernetickej bezpečnosti (Cybersecurity Act), Risk-Management Measures	Through its governance duty. What it requires
Slovenia	Zakon o informacijski varnosti (ZInfV-1), Cybersecurity Risk-Management Measures and Governance from 19 Dec 2026, in 2 months	Through its governance duty. What it requires
Spain	Real Decreto-ley 12/2018, Security Obligations for Operators of Essential Services and Digital Service Providers	Through its governance duty. What it requires
Sweden	Cybersäkerhetslag, Cybersecurity Risk-Management Measures	Through its governance duty. What it requires
Taiwan	Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit	Through its governance duty. What it requires
Taiwan	Cyber Security Management Act, Specific Non-Government Agency Cyber Security Management	Through its governance duty. What it requires
Taiwan	Telecommunications Management Act, Cyber Security and Critical Infrastructure Protection Plans	Through its governance duty. What it requires
Tonga	Cybersecurity Act 2025, Critical Infrastructure Operator Obligations from a date not yet set	Through its governance duty. What it requires

23 laws, 20 places

Place	Law	How it reaches this control
Australia	Telecommunications (Interception and Access) Act 1979, Prohibition on Interception and Civil Remedies	Through its prohibition duty. What it requires
Canada	Criminal Code, Interception of Private Communications	Through its prohibition duty. What it requires
Connecticut	Connecticut Action for Illegal Recording of Private Telephonic Communications	Through its prohibition duty. What it requires
Connecticut	Connecticut Wiretapping, Tampering with Private Communications and Eavesdropping	Through its prohibition duty. What it requires
Delaware	Delaware Violation of Privacy Statute (Surveillance and Interception Clauses)	Through its prohibition duty. What it requires
Delaware	Delaware Wiretapping, Electronic Surveillance and Interception of Communications Statute	Through its prohibition duty. What it requires
Florida	Florida Security of Communications Act, Interception and Civil Remedies	Through its prohibition duty. What it requires
Germany	Strafgesetzbuch, Violation of the Confidentiality of the Spoken Word	Through its prohibition duty. What it requires
Illinois	Illinois Eavesdropping Article, Interception and Civil Remedies (720 ILCS 5/14-2 as rewritten by Public Act 98-1142)	Through its prohibition duty. What it requires
Ireland	Irish ePrivacy Regulations	Through its prohibition duty. What it requires

AI governance

15 laws, 11 places

Place	Law	How it reaches this control
Andorra	Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra proposed	Through its DPIA duty. What it requires
Armenia	Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia proposed	Through its DPIA duty. What it requires
California	Transparency in Frontier Artificial Intelligence Act (SB 53)	Through its governance duty. What it requires
El Salvador	Ley de Fomento a la Inteligencia Artificial y Tecnologías, marco institucional, registro y evaluación de riesgos	Through its DPIA duty. What it requires
European Union	AI Act, Article 12 (record-keeping) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 19 (automatically generated logs) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 21(2) (competent authority access to automatically generated logs) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 26(6) (deployer log-keeping) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 26(9) (using Article 13 information for a data protection impact assessment) from 2 Dec 2027, in 14 months	Through its DPIA duty. What it requires
Germany	Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act	Through its governance duty. What it requires

Show the other 5 laws

Illinois	Artificial Intelligence Safety Measures Act from 1 Jan 2027, in 3 months	Through its governance duty. What it requires
Moldova	Council of Europe Framework Convention on Artificial Intelligence, signed by Moldova proposed	Through its DPIA duty. What it requires
Russia	Federal Law No. 243-FZ, Article 8, Duties of Sovereign and National Foundation Model Developers from 1 Mar 2027, in 5 months	Through its governance duty. What it requires
Vanuatu	Digital Transformation Act 2025, ICT service permit for AI and AI-related data services	Through its governance duty. What it requires
Vatican City	Guidelines on Artificial Intelligence of Vatican City State (Decree No. DCCII)	Through its governance, prohibition duties. What it requires

AI risk obligations

15 laws, 8 places

Place	Law	How it reaches this control
El Salvador	Resolución ANIA 0001/2025, registro obligatorio para decisiones consecuenciales	Through its governance duty. What it requires
European Union	AI Act, Article 10 (data and data governance) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 111(2) (2030 compliance deadline for public-authority-intended systems) from 2 Aug 2030, in 3.8 years	Through its governance duty. What it requires
European Union	AI Act, Article 14 (human oversight) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 26(10) (post-remote biometric identification authorisation) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 27 (fundamental rights impact assessment) from 2 Dec 2027, in 14 months	Through its DPIA duty. What it requires
European Union	AI Act, Article 6(3) and (4) (narrow-task derogation from Annex III high-risk classification) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 9 (risk management system) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
Indiana	Downcoding of Health Benefits Claims, automated and AI decision-making (House Enrolled Act 1271, 2026)	Through its governance duty. What it requires

Show the other 5 laws

Kyrgyzstan	Digital Code, Chapter 23: AI system design and risk-management obligations	Through its DPIA, governance duties. What it requires
Malta	Artificial Intelligence (Designation of the Information and Data Protection Commissioner for the purposes of Regulation (EU) 2024/1689) Regulations, 2025 (L.N. 227 of 2025)	Through its governance duty. What it requires
Montana	Right to Compute Act (SB 212, 2025), critical AI infrastructure risk management duty	Through its governance duty. What it requires
South Korea	AI Framework Act, Article 34 (business-operator duties for high-impact AI)	Through its governance duty. What it requires
Vietnam	Law on Artificial Intelligence, risk classification and conformity assessment	Through its governance duty. What it requires

Commercial messages

15 laws, 14 places

Place	Law	How it reaches this control
Australia	Spam Act 2003, Address-Harvesting Software and Harvested-Address Lists	Through its prohibition duty. What it requires
Canada	Canada's Anti-Spam Legislation	Through its prohibition duty. What it requires
Connecticut	Connecticut Action for Unsolicited Commercial Electronic Mail	Through its prohibition duty. What it requires
Delaware	Delaware Unrequested or Unauthorized Electronic Mail Statute	Through its prohibition duty. What it requires
European Union	ePrivacy Directive	Through its prohibition duty. What it requires
Germany	Gesetz gegen den unlauteren Wettbewerb, Commercial Electronic Messages	Through its prohibition duty. What it requires
Illinois	Illinois Electronic Mail Act	Through its prohibition duty. What it requires
Ireland	Irish ePrivacy Regulations	Through its prohibition duty. What it requires
Michigan	Unsolicited Commercial E-mail Protection Act	Through its prohibition duty. What it requires
Oklahoma	Fraudulent electronic mail messages	Through its prohibition duty. What it requires

Show the other 5 laws

Oklahoma	Unsolicited commercial electronic mail labeling and opt-out	Through its prohibition duty. What it requires
Oregon	Oregon Unsolicited Facsimile Machine Transmissions Statute	Through its prohibition duty. What it requires
Pennsylvania	Unsolicited Telecommunication Advertisement Act	Through its prohibition duty. What it requires
Texas	Regulation of Electronic Mail	Through its prohibition duty. What it requires
Washington	Commercial Electronic Mail Act, Text Messages	Through its prohibition duty. What it requires

12 laws, 11 places

Place	Law	How it reaches this control
Delaware	Delaware Pen Register and Trap and Trace Device Statute	Through its prohibition duty. What it requires
Florida	Florida Security of Communications Act, Pen Register and Trap and Trace Device Prohibition	Through its prohibition duty. What it requires
Maryland	Maryland Pen Register and Trap and Trace Device Act	Through its prohibition duty. What it requires
Montana	Limitations on Use of Pen Register or Trap and Trace Device	Through its prohibition duty. What it requires
Nevada	Nevada Pen Register and Trap and Trace Device Prohibition	Through its prohibition duty. What it requires
New Hampshire	New Hampshire Pen Register and Trap and Trace Devices Act	Through its prohibition duty. What it requires
Oklahoma	Pen register and trap and trace device installation or use	Through its prohibition duty. What it requires
Oregon	Oregon Pen Register and Trap and Trace Device Statute	Through its prohibition duty. What it requires
Pennsylvania	Consumer Protection Against Computer Spyware Act	Through its prohibition duty. What it requires
Pennsylvania	Pen Registers, Trap and Trace Devices and Telecommunication Identification Interception Devices, General Prohibition	Through its prohibition duty. What it requires

AI sector rules

11 laws, 11 places

Place	Law	How it reaches this control
Alabama	SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization	Through its governance duty. What it requires
Colorado	Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models	Through its governance duty. What it requires
Georgia	Private Review Agent Artificial Intelligence Coverage Determinations Act (SB 444) from 1 Jan 2027, in 3 months	Through its governance duty. What it requires
Illinois	Wellness and Oversight for Psychological Resources Act	Through its prohibition duty. What it requires
Maine	Use of artificial intelligence in therapy or psychotherapy services from a date not yet set	Through its governance, prohibition duties. What it requires
Mexico	Reform to the Federal Labor Law and the Federal Copyright Law, AI Voice and Image Consent Regime for Performing Artists	Through its prohibition duty. What it requires
Minnesota	Utilization Review, AI-Only Adverse Determination Prohibition from 1 Jan 2027, in 3 months	Through its governance duty. What it requires
Nevada	AB 406 (2025), licensed provider restriction on direct clinical use of AI	Through its governance, prohibition duties. What it requires
Oregon	Use of nursing titles by a nonhuman entity (HB 2748)	Through its prohibition duty. What it requires
Tennessee	Health Care AI Act, AI mental health professional representation prohibition	Through its prohibition duty. What it requires

Show the other 1 law

Utah

Health Insurance Preauthorization AI Disclosure (SB 319, 2026 General Session) from 1 Jan 2027, in 3 months

Through its governance duty. What it requires

AI transparency

10 laws, 10 places

Place	Law	How it reaches this control
Belize	Practice Direction No. 18 of 2025, ethical use of generative AI in court proceedings	Through its prohibition duty. What it requires
California	AB 2839, election materially deceptive deepfake disclaimer law blocked by a court	Through its prohibition duty. What it requires
Delaware	House Bill 316 (2024), use of deep fake technology to influence an election	Through its prohibition duty. What it requires
Jamaica	Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings	Through its governance duty. What it requires
Michigan	Distribution of Materially Deceptive Election Media (Public Act 265 of 2023)	Through its prohibition duty. What it requires
Mississippi	SB 2577 (2024), Wrongful Dissemination of Digitizations (Election Deepfakes)	Through its prohibition duty. What it requires
Montana	Deepfake Regulation Act (SB 25, 2025), election deepfake disclosure	Through its prohibition duty. What it requires
New Mexico	HB 182 (2024), AI-generated and manipulated media disclosure and disclaimer requirements in campaign advertising	Through its prohibition duty. What it requires
Pennsylvania	H.B. 811, civil liability for fraudulent misrepresentation of candidates by deepfake proposed	Through its prohibition duty. What it requires
Vermont	Vermont Synthetic Media in Elections Act	Through its prohibition duty. What it requires

Security baseline statutes

9 laws, 9 places

Place	Law	How it reaches this control
Cameroon	Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC)	Through its governance duty. What it requires
China	Data Security Law, Data Security Protection Obligations	Through its governance duty. What it requires
Gabon	Sécurité des systèmes d'information (dispositions communes)	Through its governance duty. What it requires
Kuwait	Data Classification Policy	Through its governance duty. What it requires
Kyrgyzstan	Digital Code, digital resilience baseline security measures	Through its governance duty. What it requires
Montenegro	Law on Information Security, General Security Measures	Through its governance duty. What it requires
Mozambique	Cybersecurity Law, General Security Requirements for the Public Administration and the Private Sector	Through its governance duty. What it requires
Peru	Proyecto de Ley 9906/2024-CR, Ley de Seguridad Digital o Ciberseguridad proposed	Through its governance duty. What it requires
Vietnam	Cybersecurity Law, Information System Classification and Protection Measures	Through its governance duty. What it requires

Data subject rights

2 laws, 2 places

Place	Law	How it reaches this control
Ecuador	SPDP Norma General guaranteeing personal-data protection in the use of AI systems from a date not yet set	Through its DPIA, governance duties. What it requires
Niger	Loi n° 2022-59, droits des personnes concernées	Through its prohibition duty. What it requires

Product security requirements

2 laws, 2 places

Place	Law	How it reaches this control
Australia	Security Standards for Smart Devices	Through its governance duty. What it requires
China	Cybersecurity Law, Network Product and Service Security Duties	Through its governance duty. What it requires

AI training data

1 law, 1 place

Place	Law	How it reaches this control
European Union	AI Act, Article 53 (obligations for providers of general-purpose AI models)	Through its governance duty. What it requires

Biometric privacy

1 law, 1 place

Place	Law	How it reaches this control
Uruguay	Ley N° 18.331, biometric data	Through its DPIA duty. What it requires

Computer misuse

1 law, 1 place

Place	Law	How it reaches this control
Tuvalu	Tuvalu Telecommunications Corporation Act 1993, offences and penalties	Through its prohibition duty. What it requires

1 law, 1 place

Place	Law	How it reaches this control
Florida	HB 3 (2024), social media use for minors	Through its prohibition duty. What it requires

FINOS AIGF AIR-PREV-005System Acceptance Testing

The same ground elsewhere linked through the kinds of duty both controls are mapped from

AI prohibited practices

Comprehensive regime

Enforcement supervision

Sensitive categories

Telephone contact

Sector security regimes

AI governance

AI risk obligations

Commercial messages

AI sector rules

AI transparency

Security baseline statutes

Data subject rights

Product security requirements

AI training data

Biometric privacy

Computer misuse

FINOS AIGF AIR-PREV-005System Acceptance Testing

The same ground elsewhere linked through the kinds of duty both controls are mapped from

AI prohibited practices

Comprehensive regime

Enforcement supervision

Sensitive categories

Telephone contact

Sector security regimes

Interception and recording consent

AI governance

AI risk obligations

Commercial messages

Device storage and tracking consent

AI sector rules

AI transparency

Security baseline statutes

Data subject rights

Product security requirements

AI training data

Biometric privacy

Computer misuse

Social media and minors