Law / Frameworks / FINOS AIGF / Preventative

FINOS AIGF AIR-PREV-007Legal and Contractual Frameworks for AI Systems

Robust legal and contractual agreements are essential for governing the development, procurement, deployment, and use of AI systems within a financial institution. This control ensures that comprehensive frameworks are established and maintained to manage risks, define responsibilities, protect data, and ensure compliance with legal and regulatory obligations when engaging with AI technology vendors, data providers, partners, and even in defining terms for end-users. These agreements must be thoroughly understood and actively managed to ensure adherence to all stipulated requirements.FINOS AI Governance Framework, version 2, as maintained on October 7, 2026, AIR-PREV-007

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of 8 Oct 2026.

The kinds of duty that reach it: TDM, attribution, contract terms, security, transfer.

283: laws
146: places
0: with court rulings behind them
25: not yet in force
7: proposed, not law

The same ground elsewhere linked through the kinds of duty both controls are mapped from

NIST AI RMFGOVERN 6.1 Policies and procedures are in place that address AI risks associated with third-party...
NIST AI RMFMAP 4.1 Approaches for mapping AI technology and legal risks of its components – including the...
NIST AI 600-1GAI-RISK-04 Data Privacy
NIST AI 600-1GAI-RISK-10 Intellectual Property
OWASP LLM Top 10LLM01:2026 Prompt Injection
OWASP LLM Top 10LLM02:2026 Sensitive Information Disclosure
OWASP Agentic Top 10ASI01 Agent Goal Hijack
OWASP Agentic Top 10ASI03 Identity and Privilege Abuse
MIT mitigations3.2 Data Governance
MIT mitigations2.1 Model & Infrastructure Security
NIST Privacy FrameworkID.DE-P2 Data processing ecosystem parties (e.g., service providers, customers, partners,...
NIST Privacy FrameworkID.DE-P3 Contracts with data processing ecosystem parties are used to implement appropriate...
NIST CSF 2.0GV.SC-02 Cybersecurity roles and responsibilities for suppliers, customers, and partners are...
NIST CSF 2.0GV.SC-05 Requirements to address cybersecurity risks in supply chains are established,...
CIS Controls3.8 Recording how sensitive data moves between systems and parties.
CIS Controls3.10 Encryption of sensitive data as it crosses networks.

A law in force is unmarked; the rest wear their state: not yet in force proposed

Comprehensive regime

83 laws, 81 places

Place	Law	How it reaches this control
Albania	Law No. 124/2024 On the Protection of Personal Data	Through its security duty. What it requires
Algeria	Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11	Through its security duty. What it requires
Andorra	LQPD, Llei 29/2021 del 28 d'octubre	Through its security duty. What it requires
Angola	Law on the Protection of Personal Data	Through its security duty. What it requires
Antigua and Barbuda	Data Protection Act, 2013	Through its security duty. What it requires
Argentina	Ley 25.326, Ley de Protección de los Datos Personales	Through its contract terms, security duties. What it requires
Barbados	Data Protection Act, 2019	Through its security duty. What it requires
Belarus	Law of the Republic of Belarus On Personal Data Protection	Through its contract terms, security duties. What it requires
Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel)	Through its security duty. What it requires
Bolivia	Ley General de Telecomunicaciones, Inviolabilidad y Secreto de las Comunicaciones y Protección de Datos Personales	Through its security duty. What it requires

Show the other 73 laws

Bolivia	Reglamento para el Desarrollo de TIC, Tratamiento de los Datos Personales	Through its security duty. What it requires
Bosnia and Herzegovina	Law on the Protection of Personal Data of Bosnia and Herzegovina	Through its security duty. What it requires
Botswana	Data Protection Act, 2024 (Act No. 18 of 2024)	Through its security duty. What it requires
Brazil	Lei Geral de Proteção de Dados Pessoais (LGPD)	Through its security duty. What it requires
Burkina Faso	Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel	Through its security duty. What it requires
Cabo Verde	Law No. 133/V/2001 on the Protection of Personal Data	Through its security duty. What it requires
Cambodia	Draft Law on Personal Data Protection, final draft proposed	Through its security duty. What it requires
Cameroon	Loi n°2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun from a date not yet set	Through its transfer duty. What it requires
Central African Republic	Loi n° 24.001 portant protection des données à caractère personnel	Through its contract terms, security duties. What it requires
Colombia	Ley 1581 de 2012, General Personal Data Protection	Through its security duty. What it requires
Colombia	Superintendencia Circular on AI and Personal Data	Through its security duty. What it requires
Comoros	Law on the Protection of Personal Data	Through its security duty. What it requires
Costa Rica	Protección de la Persona frente al Tratamiento de sus Datos Personales	Through its security, transfer duties. What it requires
Cuba	Ley 149/2022, De Protección de Datos Personales, general regime	Through its transfer duty. What it requires
Democratic Republic of the Congo	Digital Code, Title III: Personal Data Protection	Through its security duty. What it requires
Djibouti	Digital Code, Book I: Personal Data Protection and CNDP	Through its security duty. What it requires
Dominican Republic	Ley No. 172-13 sobre Protección Integral de los Datos Personales	Through its security duty. What it requires
Ecuador	LOPDP, comprehensive personal-data protection regime	Through its security duty. What it requires
Egypt	Law No. 151 of 2020 Promulgating the Personal Data Protection Law	Through its security duty. What it requires
El Salvador	Ley para la Protección de Datos Personales	Through its security duty. What it requires
Equatorial Guinea	Ley de Protección de Datos Personales	Through its security, transfer duties. What it requires
Eswatini	Data Protection Act, 2022 (Act No. 5 of 2022)	Through its security duty. What it requires
Ethiopia	Personal Data Protection Proclamation	Through its security duty. What it requires
European Union	General Data Protection Regulation (GDPR), Comprehensive Regime	Through its transfer duty. What it requires
Gabon	Loi n°001/2011 relative à la protection des données à caractère personnel, modifiée par la loi n°025/2023	Through its security duty. What it requires
Ghana	Data Protection Act	Through its security duty. What it requires
Grenada	Data Protection Act, No. 1 of 2023 from a date not yet set	Through its security duty. What it requires
Jamaica	Data Protection Act, 2020, registration, lawful basis and standards for processing	Through its security duty. What it requires
Kiribati	Data Protection Act 2025 from a date not yet set	Through its security duty. What it requires
Kosovo	Law No. 06/L-082 on Protection of Personal Data	Through its security duty. What it requires
Lebanon	Law No. 81/2018 on Electronic Transactions and Personal Data, Part V (Personal Data Protection)	Through its security duty. What it requires
Lesotho	Data Protection Act, 2011 (Act No. 5 of 2012)	Through its security duty. What it requires
Liberia	Telecommunications Act of 2007, Protection of Personal Information (§§ 51-52)	Through its security duty. What it requires
Madagascar	Law No. 2014-038, protection of personal data	Through its security duty. What it requires
Malawi	Electronic Transactions and Cyber Security Act, 2016, personal data processing and security duties (Part VII)	Through its security duty. What it requires
Maldives	Personal Data Protection Bill, pending before the People's Majlis proposed	Through its security duty. What it requires
Mali	Loi n° 2013-015, protection des données à caractère personnel	Through its security duty. What it requires
Marshall Islands	Personal Data Protection Act 2025, government personal-data protection principles	Through its security duty. What it requires
Mexico	Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP)	Through its security duty. What it requires
Moldova	Law No. 195/2024 on Personal Data Protection	Through its security duty. What it requires
Monaco	Loi sur la Protection des Données Personnelles	Through its security duty. What it requires
Montenegro	Law on Personal Data Protection from a date not yet set	Through its contract terms, security duties. What it requires
Morocco	Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data	Through its security duty. What it requires
Mozambique	Electronic Transactions Law, Protection of Personal Electronic Data	Through its security duty. What it requires
Nauru	Communications and Broadcasting Act 2018, confidentiality of subscriber information and communications	Through its security duty. What it requires
Nicaragua	Ley No. 787, Ley de Protección de Datos Personales	Through its security duty. What it requires
Niger	Loi n° 2022-59, protection des données à caractère personnel	Through its security duty. What it requires
Panama	Ley 81 de 2019, Sobre Protección de Datos Personales	Through its security duty. What it requires
Paraguay	Ley N° 7593/2025, de Protección de Datos Personales en la República del Paraguay from 27 Nov 2027, in 14 months	Through its security duty. What it requires
Peru	Ley 29733, Ley de Protección de Datos Personales	Through its security duty. What it requires
Republic of the Congo	Law No. 29-2019 on the Protection of Personal Data	Through its security duty. What it requires
Rwanda	Law relating to the Protection of Personal Data and Privacy	Through its contract terms, security duties. What it requires
Saint Kitts and Nevis	Data Protection Act, 2018 from a date not yet set	Through its security duty. What it requires
Saint Lucia	Data Protection Act	Through its security duty. What it requires
Samoa	Telecommunications Act 2005, confidentiality and protection of customer personal information	Through its security duty. What it requires
San Marino	San Marino Law No. 171 on the Protection of Natural Persons	Through its security duty. What it requires
Sao Tome and Principe	Lei n.º 03/2016, Protecção de Dados Pessoais	Through its security duty. What it requires
Senegal	Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel (Personal Data Protection Act)	Through its security duty. What it requires
Solomon Islands	Telecommunications Act 2009, Confidentiality and Consent Duties	Through its security duty. What it requires
Somalia	Data Protection Act No. 005 of 2023	Through its security duty. What it requires
South Africa	Protection of Personal Information Act 4 of 2013 (POPIA)	Through its security duty. What it requires
Suriname	Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens) proposed	Through its security duty. What it requires
Syria	Law No. 12 of 2024 on Protection of Electronic Personal Data	Through its security duty. What it requires
Taiwan	Personal Data Protection Act (個人資料保護法)	Through its transfer duty. What it requires
Togo	Loi n° 2019-014, protection des données à caractère personnel	Through its security duty. What it requires
Tonga	Privacy Act 2025, comprehensive personal information protection regime from a date not yet set	Through its security duty. What it requires
Uganda	Data Protection and Privacy Act, 2019, comprehensive personal-data regime	Through its security duty. What it requires
Ukraine	Law of Ukraine On the Protection of Personal Data	Through its transfer duty. What it requires
Uruguay	Ley N° 18.331, Personal Data Protection and Habeas Data Law, as amended	Through its security duty. What it requires
Vanuatu	Data Protection and Privacy Act 2024, comprehensive personal data protection regime	Through its security duty. What it requires
Vatican City	General Regulation on the Protection of Personal Data for Vatican City State	Through its security duty. What it requires
Zambia	Data Protection Act, 2021, personal data processing framework	Through its security duty. What it requires
Zimbabwe	Cyber and Data Protection Act [Chapter 12:07]	Through its security duty. What it requires

Cross border transfer

76 laws, 76 places

Place	Law	How it reaches this control
Albania	Law No. 124/2024, international data transfer	Through its transfer duty. What it requires
Algeria	Loi n° 18-07 relative à la protection des personnes physiques, transfert de données vers un pays étranger	Through its transfer duty. What it requires
Andorra	LQPD, transfers of personal data to third countries or international organisations	Through its transfer duty. What it requires
Angola	Law on the Protection of Personal Data, cross border transfer	Through its transfer duty. What it requires
Argentina	Ley 25.326, cross-border transfer	Through its transfer duty. What it requires
Barbados	Data Protection Act, 2019, transfers of personal data outside of Barbados	Through its transfer duty. What it requires
Belarus	Law of the Republic of Belarus On Personal Data Protection, cross border transfer of personal data	Through its transfer duty. What it requires
Belize	Data Protection Act 2021, cross-border transfer of personal data from a date not yet set	Through its transfer duty. What it requires
Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, transfert transfrontalier de données	Through its transfer duty. What it requires
Bosnia and Herzegovina	Law on the Protection of Personal Data of Bosnia and Herzegovina, cross-border transfer	Through its transfer duty. What it requires

Show the other 66 laws

Botswana	Data Protection Act, 2024, transfer of personal data to third countries or international organisations	Through its transfer duty. What it requires
Brazil	LGPD, international transfer of data	Through its transfer duty. What it requires
Burkina Faso	Personal Data Protection Law, cross-border transfer of personal data	Through its transfer duty. What it requires
Cabo Verde	Law No. 133/V/2001 on the Protection of Personal Data, cross border transfer	Through its transfer duty. What it requires
Cambodia	Cambodia's Draft Law on Personal Data Protection, cross-border data transfer proposed	Through its transfer duty. What it requires
Central African Republic	Loi n° 24.001 portant protection des données à caractère personnel, flux transfrontalier	Through its transfer duty. What it requires
Chad	Loi n°007/PR/2015, transfert des données vers un pays non membre de la CEEAC/CEMAC	Through its transfer duty. What it requires
Colombia	Ley 1581 de 2012, Cross Border Data Transfer	Through its transfer duty. What it requires
Comoros	Law on the Protection of Personal Data, transfer to a foreign state	Through its transfer duty. What it requires
Cuba	Resolución 58/2022 (MINCOM), security and localization rules for personal data in electronic form	Through its security, transfer duties. What it requires
Côte d'Ivoire	Law No. 2013-450 on the Protection of Personal Data, cross-border transfer	Through its transfer duty. What it requires
Democratic Republic of the Congo	Digital Code, Title III, cross-border transfer of personal data	Through its transfer duty. What it requires
Djibouti	Digital Code, Book I: cross-border transfer of personal data	Through its transfer duty. What it requires
Dominican Republic	Ley No. 172-13 sobre Protección Integral de los Datos Personales, cross border transfer of data	Through its transfer duty. What it requires
Ecuador	LOPDP, transferencia internacional de datos personales	Through its transfer duty. What it requires
Egypt	Egypt Personal Data Protection Law, cross-border transfer of Personal Data	Through its transfer duty. What it requires
El Salvador	Ley para la Protección de Datos Personales, cross border transfer of personal data	Through its transfer duty. What it requires
Eswatini	Data Protection Act, 2022, transfer of personal information outside Eswatini	Through its transfer duty. What it requires
Ethiopia	Personal Data Protection Proclamation, cross-border transfer and data sovereignty	Through its transfer duty. What it requires
Gabon	Law No. 025/2023, interconnection and cross-border transfer of personal data	Through its transfer duty. What it requires
Gambia	Personal Data Protection and Privacy Act, 2025, transfer of personal data outside The Gambia from a date not yet set	Through its transfer duty. What it requires
Ireland	GDPR Chapter V, Cross-Border Transfer of Personal Data from Ireland	Through its transfer duty. What it requires
Jamaica	Data Protection Act, 2020, transfer of personal data outside Jamaica	Through its transfer duty. What it requires
Kiribati	Data Protection Act 2025, processing and transfers outside Kiribati from a date not yet set	Through its transfer duty. What it requires
Kosovo	Law No. 06/L-082 on Protection of Personal Data, transfer of personal data to other states and international organisations	Through its transfer duty. What it requires
Lebanon	Law No. 81/2018, Part V, transfer of personal data to another State	Through its transfer duty. What it requires
Lesotho	Data Protection Act, 2011, transfer of personal information outside Lesotho	Through its transfer duty. What it requires
Libya	Law No. 6 of 2022, cross border transfer of personal data	Through its transfer duty. What it requires
Madagascar	Law No. 2014-038, cross-border transfer of personal data	Through its transfer duty. What it requires
Maldives	Maldives Personal Data Protection Bill, cross-border transfers proposed	Through its transfer duty. What it requires
Mali	Loi n° 2013-015, transfer of personal data abroad	Through its transfer duty. What it requires
Mauritania	Loi n° 2017-020, transferts vers un pays tiers	Through its transfer duty. What it requires
Mexico	Ley Federal de Protección de Datos Personales en Posesión de los Particulares, transfer of personal data	Through its transfer duty. What it requires
Moldova	Moldova Law No. 195/2024, transfers of personal data abroad	Through its transfer duty. What it requires
Monaco	Loi sur la Protection des Données Personnelles, transfert des données	Through its transfer duty. What it requires
Montenegro	Law on Personal Data Protection, transfer of personal data from Montenegro from a date not yet set	Through its transfer duty. What it requires
Morocco	Law No. 09-08, transfer of data to a foreign country	Through its transfer duty. What it requires
Nicaragua	Ley No. 787, Ley de Protección de Datos Personales, cross border transfer of data	Through its transfer duty. What it requires
Niger	Loi n° 2022-59, transfert transfrontalier des données	Through its security, transfer duties. What it requires
Nigeria	Nigeria Data Protection Act, 2023, cross-border data transfer	Through its transfer duty. What it requires
North Macedonia	Law on Personal Data Protection (LPDP), transfer of personal data	Through its transfer duty. What it requires
Panama	Ley 81 de 2019, cross border transfer of personal data	Through its transfer duty. What it requires
Paraguay	Ley N° 7593/2025, transferencias internacionales de datos personales from 27 Nov 2027, in 14 months	Through its transfer duty. What it requires
Peru	Ley 29733, cross-border transfer of personal data	Through its transfer duty. What it requires
Republic of the Congo	Law No. 29-2019, cross-border transfer of personal data	Through its transfer duty. What it requires
Rwanda	Law relating to the Protection of Personal Data and Privacy, cross-border transfer and data storage	Through its contract terms, transfer duties. What it requires
Saint Lucia	Data Protection Act, transfer of personal data from a date not yet set	Through its transfer duty. What it requires
San Marino	San Marino Law No. 171, transfers of personal data abroad	Through its transfer duty. What it requires
Sao Tome and Principe	Lei n.º 03/2016, transfer of personal data abroad	Through its transfer duty. What it requires
Senegal	Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel, transferts vers un pays tiers	Through its transfer duty. What it requires
Serbia	Law on Personal Data Protection, transfer of personal data to other states	Through its transfer duty. What it requires
Somalia	Data Protection Act, 2023, cross-border transfers of personal data	Through its transfer duty. What it requires
South Africa	Protection of Personal Information Act, cross-border transfer	Through its transfer duty. What it requires
Suriname	Draft Law on the Protection of Privacy and Personal Data, cross border transfer proposed	Through its transfer duty. What it requires
Syria	Law No. 12 of 2024 on Protection of Electronic Personal Data, cross border transfer	Through its transfer duty. What it requires
Togo	Loi n° 2019-014, transfert des données vers un pays tiers	Through its transfer duty. What it requires
Tonga	Privacy Act 2025, transfers of personal information outside the Kingdom from a date not yet set	Through its transfer duty. What it requires
Trinidad and Tobago	Data Protection Act, 2011, cross border disclosure of personal information	Through its transfer duty. What it requires
Tunisia	Organic Act on the Protection of Personal Data, cross-border transfer	Through its transfer duty. What it requires
Uganda	Data Protection and Privacy Act, 2019, cross-border transfer	Through its transfer duty. What it requires
United Kingdom	UK GDPR Articles 44A-50, Cross-Border Transfer of Personal Data from the United Kingdom	Through its transfer duty. What it requires
United States	DOJ Data Security Program (Bulk Sensitive Personal Data Rule)	Through its security, transfer duties. What it requires
Uruguay	Ley N° 18.331, cross border transfer of personal data	Through its transfer duty. What it requires
Vanuatu	Data Protection and Privacy Act 2024, transborder data flows	Through its transfer duty. What it requires
Zambia	Data Protection Act, 2021, transfer of personal data outside the Republic	Through its transfer duty. What it requires
Zimbabwe	Cyber and Data Protection Act, transfer of personal information outside Zimbabwe	Through its transfer duty. What it requires

Security baseline statutes

33 laws, 31 places

Place	Law	How it reaches this control
Alabama	Data Breach Notification Act, reasonable security measures and disposal of records	Through its security duty. What it requires
Arkansas	Arkansas Personal Information Protection Act, reasonable security procedures	Through its security duty. What it requires
Belarus	Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40)	Through its security duty. What it requires
California	Customer Records Act, Reasonable Security Procedures	Through its security duty. What it requires
China	Data Security Law, Data Security Protection Obligations	Through its security duty. What it requires
Colorado	Protection of personal identifying information, reasonable security procedures duty	Through its security duty. What it requires
Connecticut	Connected device provider's duty to protect recorded personal information with reasonable security measures	Through its security duty. What it requires
Connecticut	Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty	Through its security duty. What it requires
Cuba	Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty	Through its security duty. What it requires
Delaware	Computer Security Breaches, protection of personal information	Through its security duty. What it requires

Show the other 23 laws

Democratic Republic of the Congo	Digital Code, Livre IV: Digital Services Provider Security Obligations	Through its security duty. What it requires
District of Columbia	Security requirements for personal information (Security Breach Protection Amendment Act of 2020)	Through its security duty. What it requires
Florida	Florida Information Protection Act, data security and disposal duty	Through its security duty. What it requires
Illinois	Personal Information Protection Act, data security duty	Through its security duty. What it requires
Indiana	Disclosure of Security Breach Act, data base owner's duty to maintain reasonable security procedures and dispose of records from a date not yet set	Through its security duty. What it requires
Kansas	Kansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information	Through its security duty. What it requires
Kazakhstan	Digital Code, general cybersecurity duty on digital-object owners and holders	Through its security duty. What it requires
Kuwait	Data Classification Policy	Through its security duty. What it requires
Louisiana	Database Security Breach Notification Law, reasonable security procedures and destruction duty	Through its security duty. What it requires
Maryland	Maryland Personal Information Protection Act (MPIPA), safeguards and secure-disposal duty	Through its security duty. What it requires
Massachusetts	Standards for the Protection of Personal Information of Residents of the Commonwealth	Through its security duty. What it requires
Mexico	Ley Federal de Protección al Consumidor, Electronic Transaction Security Duty (Arts. 76 Bis, 76 Bis 1)	Through its security duty. What it requires
Montenegro	Law on Information Security, General Security Measures	Through its security duty. What it requires
Nebraska	Financial Data Protection and Consumer Notification of Data Security Breach Act, security procedures and practices duty	Through its security duty. What it requires
Nevada	Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield from a date not yet set	Through its security duty. What it requires
Nevada	Security measures for data collectors maintaining personal information from a date not yet set	Through its security duty. What it requires
New Mexico	Data Breach Notification Act, security and disposal duties from a date not yet set	Through its security duty. What it requires
Oregon	Oregon Consumer Information Protection Act, requirement to develop safeguards for personal information	Through its security duty. What it requires
Rhode Island	Identity Theft Protection Act of 2015, risk-based information security program from a date not yet set	Through its security duty. What it requires
Texas	Identity Theft Enforcement and Protection Act, business duty to protect sensitive personal information	Through its security duty. What it requires
Turkmenistan	Law on Information and Its Protection, information-security duty	Through its security duty. What it requires
Utah	Protection of Personal Information Act, reasonable procedures and records-destruction duty	Through its security duty. What it requires
Vietnam	Cybersecurity Law, Information System Classification and Protection Measures	Through its security duty. What it requires

Copyright and text and data mining (TDM)

20 laws, 20 places

Place	Law	How it reaches this control
Belgium	Code de droit économique, article XI.190, 20°, exception de fouille de textes et de données	Through its TDM duty. What it requires
Bosnia and Herzegovina	Law on Copyright and Related Rights, Content Limitations (No Text-and-Data-Mining Exception)	Through its TDM duty. What it requires
Bulgaria	Copyright and Neighbouring Rights Act (ZAPSP), Arts. 26e, 26zh and 26k, Text-and-Data-Mining Exception for Crawling and Training	Through its TDM duty. What it requires
Cayman Islands	Copyright (Cayman Islands) Order 2015, text and data analysis exception	Through its TDM duty. What it requires
Cook Islands	Copyright Act 2013, economic rights, computer program copying, and technological protection measures	Through its TDM duty. What it requires
Czech Republic	Autorský zákon Sections 39c-39d, Text and Data Mining Exception for Automated Analysis	Through its TDM duty. What it requires
Dominica	Copyright Act 2003, temporary reproduction and quotation exceptions	Through its attribution duty. What it requires
European Union	DSM Directive, Article 4 (text-and-data-mining exception and rights reservation)	Through its TDM duty. What it requires
Fiji	Copyright Act 1999, Fair Dealing and Criminal Liability for Infringement from a date not yet set	Through its TDM duty. What it requires
Georgia	Copyright and Related Rights, no text-and-data-mining exception	Through its TDM duty. What it requires

Show the other 10 laws

Honduras	Ley del Derecho de Autor, sin excepción de minería de textos y datos, protección de compilaciones	Through its TDM duty. What it requires
Italy	Legge sul Diritto d'Autore Artt. 70-ter and 70-quater, Text-and-Data-Mining Exceptions	Through its TDM duty. What it requires
Latvia	Autortiesību likums Article 21.1, Text and Data Mining Exception (Scraping and AI Training)	Through its TDM duty. What it requires
Maldives	Copyright and Related Rights Act, quotation and informational-purpose exceptions	Through its attribution duty. What it requires
Papua New Guinea	Copyright and Neighbouring Rights Act 2000, Exceptions to Copyright and Enforcement	Through its attribution duty. What it requires
Paraguay	Ley N° 1328/1998, arts. 8, 40 y 41, límites y excepciones al derecho de autor	Through its TDM duty. What it requires
Poland	Ustawa o prawie autorskim i prawach pokrewnych, Text-and-Data-Mining Exceptions	Through its TDM duty. What it requires
Romania	Legea nr. 8/1996 privind dreptul de autor și drepturile conexe, art. 36^1-36^2, Text and Data Mining Exceptions, inserted by Legea nr. 69/2022	Through its TDM duty. What it requires
Uruguay	Ley N° 9.739 arts. 44-45, illicit-reproduction rule and free-use exceptions for quotation and news	Through its attribution duty. What it requires
Vatican City	Copyright and related rights by reference to Italian law (Legge N. CXCVII)	Through its attribution duty. What it requires

Snippet reproduction

17 laws, 17 places

Place	Law	How it reaches this control
Algeria	Ordonnance n° 03-05, exception de citation	Through its attribution duty. What it requires
Andorra	Copyright and Neighboring Rights Law, Press and Current-Events Reproduction Exception	Through its attribution duty. What it requires
Bahamas	Copyright Act 1998, fair dealing for reporting current events and criticism	Through its attribution duty. What it requires
Bermuda	Copyright and Designs Act 2004, fair dealing for criticism, review and reporting current events	Through its attribution duty. What it requires
Comoros	Law on Literary and Artistic Property, quotation and press-review exception	Through its attribution duty. What it requires
Cook Islands	Copyright Act 2013, quoting and current-events reporting exceptions	Through its attribution duty. What it requires
Dominica	Copyright Act 2003, news reproduction and press-article exceptions	Through its attribution duty. What it requires
Gabon	Loi n°1/87, exception de courte citation et revue de presse	Through its attribution duty. What it requires
Honduras	Ley del Derecho de Autor, reproducción de informaciones y noticias de actualidad	Through its attribution duty. What it requires
Libya	Law No. 9 of 1968, quotation and newspaper-reproduction exceptions	Through its attribution duty. What it requires

Show the other 7 laws

Nauru	Copyright Act 2019, news and current-events exceptions to copyright	Through its attribution duty. What it requires
Nicaragua	Ley No. 312, quotation and press-reproduction limitations	Through its attribution duty. What it requires
Puerto Rico	Ley de Derechos Morales de Autor de Puerto Rico, news and criticism exception	Through its attribution duty. What it requires
Sao Tome and Principe	Decreto-Lei n.º 02/2017, exclusão das notícias do dia, revista de imprensa e citação	Through its attribution duty. What it requires
Seychelles	Copyright Act, news reproduction and press-article exceptions	Through its attribution duty. What it requires
Tonga	Copyright Act 2002, Reproduction of Newspaper Articles and Quotation Exceptions	Through its attribution duty. What it requires
Tunisia	Copyright Act, Facts Exclusion and Quotation and Press-Review Exception	Through its attribution duty. What it requires

Sector security regimes

16 laws, 16 places

Place	Law	How it reaches this control
Angola	Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases	Through its security duty. What it requires
Burundi	Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers	Through its security duty. What it requires
Democratic Republic of the Congo	Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty	Through its security duty. What it requires
Djibouti	Digital Code, Book VI: Critical Installation Protection and Operator Security Controls	Through its security duty. What it requires
Ethiopia	Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations from 21 Jul 2027, in 9 months	Through its security duty. What it requires
Haiti	BRH Circulaire 126, Information Security Rules for Financial Institutions	Through its security duty. What it requires
Iceland	Minimum Risk-Management and Preparedness Requirements for Critical Infrastructure	Through its security duty. What it requires
Latvia	Nacionālās kiberdrošības likums, Cybersecurity Risk-Management Measures	Through its security duty. What it requires
Lebanon	Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts)	Through its security duty. What it requires
Liberia	Telecommunications Act 2007, Security Safeguards for Customer Information and Communications	Through its security duty. What it requires

Show the other 6 laws

Micronesia	FSM Telecommunications Act of 2014, Security Safeguards for Customer Information	Through its security duty. What it requires
Serbia	Law on Information Security, ICT Systems of Special Importance and Security Measures	Through its security duty. What it requires
Solomon Islands	Telecommunications Act 2009, Security Safeguards for Consumer Information	Through its security duty. What it requires
Taiwan	Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit	Through its security duty. What it requires
Tonga	Cybersecurity Act 2025, Critical Infrastructure Operator Obligations from a date not yet set	Through its security duty. What it requires
Turkmenistan	Law on Communications, network and subscriber-information protection duties	Through its security duty. What it requires

Database right

8 laws, 8 places

Place	Law	How it reaches this control
Bahamas	Copyright Act 1998, compilation and database protection	Through its attribution duty. What it requires
Burkina Faso	Loi n°048-2019/AN du 12 novembre 2019 portant protection de la propriété littéraire et artistique, database and news exceptions	Through its attribution duty. What it requires
Burundi	Law No. 1/021 of December 30, 2005 on the Protection of Copyright and Related Rights, database and facts exclusions	Through its attribution duty. What it requires
Cayman Islands	Copyright (Cayman Islands) Order 2015, database and compilation copyright	Through its attribution duty. What it requires
Dominica	Copyright Act 2003, database and compilation protection	Through its attribution duty. What it requires
Gabon	Loi n°1/87, protection des recueils et compilations	Through its attribution duty. What it requires
Nicaragua	Ley No. 312, protection of compilations and databases	Through its attribution duty. What it requires
Sao Tome and Principe	Decreto-Lei n.º 02/2017, protecção de compilações e exclusão das notícias do dia	Through its attribution duty. What it requires

Product security requirements

8 laws, 8 places

Place	Law	How it reaches this control
Australia	Security Standards for Smart Devices	Through its security duty. What it requires
Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits	Through its security duty. What it requires
Brazil	Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment)	Through its security duty. What it requires
California	Security of Connected Devices	Through its security duty. What it requires
China	Cybersecurity Law, Network Product and Service Security Duties	Through its security duty. What it requires
Cyprus	Security of Networks and Information Systems Law, Radio Equipment Cybersecurity Requirements	Through its security duty. What it requires
Oregon	Security requirements for Internet-connected devices	Through its security duty. What it requires
United Kingdom	Product Security Requirements for Connectable Products	Through its security duty. What it requires

Vulnerability and incident reporting

8 laws, 8 places

Place	Law	How it reaches this control
Angola	Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties	Through its security duty. What it requires
China	Data Security Law, Risk Monitoring and Incident Reporting Duty	Through its security duty. What it requires
Latvia	Nacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation	Through its security duty. What it requires
Marshall Islands	Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations	Through its security duty. What it requires
Micronesia	FSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock proposed	Through its security duty. What it requires
Taiwan	Cyber Security Management Act, Cyber Security Incident Reporting	Through its security duty. What it requires
Tunisia	Cybersecurity Incident Reporting and Emergency Response	Through its security duty. What it requires
Vietnam	Cybersecurity Law, Incident Response and Reporting Duties	Through its security duty. What it requires

Sensitive categories

5 laws, 5 places

Place	Law	How it reaches this control
Angola	Law on the Protection of Personal Data, sensitive data categories	Through its security duty. What it requires
Cabo Verde	Law No. 133/V/2001 on the Protection of Personal Data, sensitive data categories	Through its security duty. What it requires
Morocco	Law No. 09-08, sensitive personal data and offense records	Through its security duty. What it requires
Rwanda	Law relating to the Protection of Personal Data and Privacy, sensitive personal data and children's data	Through its security duty. What it requires
Sao Tome and Principe	Lei n.º 03/2016, sensitive categories and suspect records	Through its security duty. What it requires

AI risk obligations

2 laws, 1 place

Place	Law	How it reaches this control
European Union	AI Act, Article 15 (accuracy, robustness and cybersecurity) from 2 Dec 2027, in 14 months	Through its security duty. What it requires
European Union	AI Act, Article 25 (responsibilities along the AI value chain) from 2 Dec 2027, in 14 months	Through its contract terms duty. What it requires

Enforcement supervision

2 laws, 2 places

Place	Law	How it reaches this control
Idaho	Student Data Accessibility, Transparency and Accountability Act (SDATAA) from a date not yet set	Through its transfer duty. What it requires
Zimbabwe	Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024	Through its security duty. What it requires

Press publishers' right

2 laws, 2 places

Place	Law	How it reaches this control
Bulgaria	Copyright and Neighbouring Rights Act (ZAPSP), Arts. 90d and 90zh, Press Publisher Right	Through its attribution duty. What it requires
Italy	Legge sul Diritto d'Autore Art. 43-bis, Press Publisher Neighbouring Right	Through its attribution duty. What it requires

AI sector rules

1 law, 1 place

Place	Law	How it reaches this control
Mexico	Reform to the Federal Labor Law and the Federal Copyright Law, AI Voice and Image Consent Regime for Performing Artists	Through its contract terms duty. What it requires

AI training data

1 law, 1 place

Place	Law	How it reaches this control
European Union	AI Act, Article 53 (obligations for providers of general-purpose AI models)	Through its TDM duty. What it requires

Breach notification

1 law, 1 place

Place	Law	How it reaches this control
Samoa	National Digital Identification Act 2024, personal data breach notification	Through its security duty. What it requires

Full text of the FINOS AI Governance Framework, CC BY 4.0. FINOS AI Governance Framework, https://air-governance-framework.finos.org/, copyright 2025 FINOS, licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Titles and purpose text are quoted; markdown emphasis and links were removed. Every control of the framework.

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.