Law / Frameworks / FINOS AIGF / Preventative

FINOS AIGF AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems

The increasing integration of Artificial Intelligence (AI) into financial applications, particularly through Generative AI, Retrieval Augmented Generation (RAG), and Agentic workflows, introduces significant operational risks. These include potential disruptions in service availability, degradation of performance, and inequities in service delivery. This control addresses the critical need to ensure Quality of Service (QoS) and implement robust Distributed Denial of Service (DDoS) prevention measures for AI systems.FINOS AI Governance Framework, version 2, as maintained on October 7, 2026, AIR-PREV-008

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of 8 Oct 2026.

The kinds of duty that reach it: security.

154: laws
116: places
0: with court rulings behind them
14: not yet in force
4: proposed, not law

The same ground elsewhere linked through the kinds of duty both controls are mapped from

NIST AI RMFMEASURE 2.5 The AI system to be deployed is demonstrated to be valid and reliable. Limitations of...
NIST AI RMFMEASURE 2.6 The AI system is evaluated regularly for safety risks – as identified in the MAP...
NIST AI 600-1GAI-RISK-04 Data Privacy
NIST AI 600-1GAI-RISK-09 Information Security
OWASP LLM Top 10LLM01:2026 Prompt Injection
OWASP LLM Top 10LLM02:2026 Sensitive Information Disclosure
OWASP Agentic Top 10ASI01 Agent Goal Hijack
OWASP Agentic Top 10ASI03 Identity and Privilege Abuse
MIT mitigations2.1 Model & Infrastructure Security
MIT mitigations2.3 Model Safety Engineering
NIST Privacy FrameworkPR.PO-P7 Response plans (Incident Response and Business Continuity) and recovery plans...
NIST Privacy FrameworkPR.PO-P10 A vulnerability management plan is developed and implemented.
NIST CSF 2.0ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded
NIST CSF 2.0ID.RA-08 Processes for receiving, analyzing, and responding to vulnerability disclosures are established
CIS Controls3.10 Encryption of sensitive data as it crosses networks.
CIS Controls3.11 Encryption of sensitive data where it is stored on servers and applications.

A law in force is unmarked; the rest wear their state: not yet in force proposed

Comprehensive regime

78 laws, 76 places

Place	Law	How it reaches this control
Albania	Law No. 124/2024 On the Protection of Personal Data	Through its security duty. What it requires
Algeria	Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11	Through its security duty. What it requires
Andorra	LQPD, Llei 29/2021 del 28 d'octubre	Through its security duty. What it requires
Angola	Law on the Protection of Personal Data	Through its security duty. What it requires
Antigua and Barbuda	Data Protection Act, 2013	Through its security duty. What it requires
Argentina	Ley 25.326, Ley de Protección de los Datos Personales	Through its security duty. What it requires
Barbados	Data Protection Act, 2019	Through its security duty. What it requires
Belarus	Law of the Republic of Belarus On Personal Data Protection	Through its security duty. What it requires
Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel)	Through its security duty. What it requires
Bolivia	Ley General de Telecomunicaciones, Inviolabilidad y Secreto de las Comunicaciones y Protección de Datos Personales	Through its security duty. What it requires

Show the other 68 laws

Bolivia	Reglamento para el Desarrollo de TIC, Tratamiento de los Datos Personales	Through its security duty. What it requires
Bosnia and Herzegovina	Law on the Protection of Personal Data of Bosnia and Herzegovina	Through its security duty. What it requires
Botswana	Data Protection Act, 2024 (Act No. 18 of 2024)	Through its security duty. What it requires
Brazil	Lei Geral de Proteção de Dados Pessoais (LGPD)	Through its security duty. What it requires
Burkina Faso	Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel	Through its security duty. What it requires
Cabo Verde	Law No. 133/V/2001 on the Protection of Personal Data	Through its security duty. What it requires
Cambodia	Draft Law on Personal Data Protection, final draft proposed	Through its security duty. What it requires
Central African Republic	Loi n° 24.001 portant protection des données à caractère personnel	Through its security duty. What it requires
Colombia	Ley 1581 de 2012, General Personal Data Protection	Through its security duty. What it requires
Colombia	Superintendencia Circular on AI and Personal Data	Through its security duty. What it requires
Comoros	Law on the Protection of Personal Data	Through its security duty. What it requires
Costa Rica	Protección de la Persona frente al Tratamiento de sus Datos Personales	Through its security duty. What it requires
Democratic Republic of the Congo	Digital Code, Title III: Personal Data Protection	Through its security duty. What it requires
Djibouti	Digital Code, Book I: Personal Data Protection and CNDP	Through its security duty. What it requires
Dominican Republic	Ley No. 172-13 sobre Protección Integral de los Datos Personales	Through its security duty. What it requires
Ecuador	LOPDP, comprehensive personal-data protection regime	Through its security duty. What it requires
Egypt	Law No. 151 of 2020 Promulgating the Personal Data Protection Law	Through its security duty. What it requires
El Salvador	Ley para la Protección de Datos Personales	Through its security duty. What it requires
Equatorial Guinea	Ley de Protección de Datos Personales	Through its security duty. What it requires
Eswatini	Data Protection Act, 2022 (Act No. 5 of 2022)	Through its security duty. What it requires
Ethiopia	Personal Data Protection Proclamation	Through its security duty. What it requires
Gabon	Loi n°001/2011 relative à la protection des données à caractère personnel, modifiée par la loi n°025/2023	Through its security duty. What it requires
Ghana	Data Protection Act	Through its security duty. What it requires
Grenada	Data Protection Act, No. 1 of 2023 from a date not yet set	Through its security duty. What it requires
Jamaica	Data Protection Act, 2020, registration, lawful basis and standards for processing	Through its security duty. What it requires
Kiribati	Data Protection Act 2025 from a date not yet set	Through its security duty. What it requires
Kosovo	Law No. 06/L-082 on Protection of Personal Data	Through its security duty. What it requires
Lebanon	Law No. 81/2018 on Electronic Transactions and Personal Data, Part V (Personal Data Protection)	Through its security duty. What it requires
Lesotho	Data Protection Act, 2011 (Act No. 5 of 2012)	Through its security duty. What it requires
Liberia	Telecommunications Act of 2007, Protection of Personal Information (§§ 51-52)	Through its security duty. What it requires
Madagascar	Law No. 2014-038, protection of personal data	Through its security duty. What it requires
Malawi	Electronic Transactions and Cyber Security Act, 2016, personal data processing and security duties (Part VII)	Through its security duty. What it requires
Maldives	Personal Data Protection Bill, pending before the People's Majlis proposed	Through its security duty. What it requires
Mali	Loi n° 2013-015, protection des données à caractère personnel	Through its security duty. What it requires
Marshall Islands	Personal Data Protection Act 2025, government personal-data protection principles	Through its security duty. What it requires
Mexico	Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP)	Through its security duty. What it requires
Moldova	Law No. 195/2024 on Personal Data Protection	Through its security duty. What it requires
Monaco	Loi sur la Protection des Données Personnelles	Through its security duty. What it requires
Montenegro	Law on Personal Data Protection from a date not yet set	Through its security duty. What it requires
Morocco	Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data	Through its security duty. What it requires
Mozambique	Electronic Transactions Law, Protection of Personal Electronic Data	Through its security duty. What it requires
Nauru	Communications and Broadcasting Act 2018, confidentiality of subscriber information and communications	Through its security duty. What it requires
Nicaragua	Ley No. 787, Ley de Protección de Datos Personales	Through its security duty. What it requires
Niger	Loi n° 2022-59, protection des données à caractère personnel	Through its security duty. What it requires
Panama	Ley 81 de 2019, Sobre Protección de Datos Personales	Through its security duty. What it requires
Paraguay	Ley N° 7593/2025, de Protección de Datos Personales en la República del Paraguay from 27 Nov 2027, in 14 months	Through its security duty. What it requires
Peru	Ley 29733, Ley de Protección de Datos Personales	Through its security duty. What it requires
Republic of the Congo	Law No. 29-2019 on the Protection of Personal Data	Through its security duty. What it requires
Rwanda	Law relating to the Protection of Personal Data and Privacy	Through its security duty. What it requires
Saint Kitts and Nevis	Data Protection Act, 2018 from a date not yet set	Through its security duty. What it requires
Saint Lucia	Data Protection Act	Through its security duty. What it requires
Samoa	Telecommunications Act 2005, confidentiality and protection of customer personal information	Through its security duty. What it requires
San Marino	San Marino Law No. 171 on the Protection of Natural Persons	Through its security duty. What it requires
Sao Tome and Principe	Lei n.º 03/2016, Protecção de Dados Pessoais	Through its security duty. What it requires
Senegal	Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel (Personal Data Protection Act)	Through its security duty. What it requires
Solomon Islands	Telecommunications Act 2009, Confidentiality and Consent Duties	Through its security duty. What it requires
Somalia	Data Protection Act No. 005 of 2023	Through its security duty. What it requires
South Africa	Protection of Personal Information Act 4 of 2013 (POPIA)	Through its security duty. What it requires
Suriname	Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens) proposed	Through its security duty. What it requires
Syria	Law No. 12 of 2024 on Protection of Electronic Personal Data	Through its security duty. What it requires
Togo	Loi n° 2019-014, protection des données à caractère personnel	Through its security duty. What it requires
Tonga	Privacy Act 2025, comprehensive personal information protection regime from a date not yet set	Through its security duty. What it requires
Uganda	Data Protection and Privacy Act, 2019, comprehensive personal-data regime	Through its security duty. What it requires
Uruguay	Ley N° 18.331, Personal Data Protection and Habeas Data Law, as amended	Through its security duty. What it requires
Vanuatu	Data Protection and Privacy Act 2024, comprehensive personal data protection regime	Through its security duty. What it requires
Vatican City	General Regulation on the Protection of Personal Data for Vatican City State	Through its security duty. What it requires
Zambia	Data Protection Act, 2021, personal data processing framework	Through its security duty. What it requires
Zimbabwe	Cyber and Data Protection Act [Chapter 12:07]	Through its security duty. What it requires

Security baseline statutes

33 laws, 31 places

Place	Law	How it reaches this control
Alabama	Data Breach Notification Act, reasonable security measures and disposal of records	Through its security duty. What it requires
Arkansas	Arkansas Personal Information Protection Act, reasonable security procedures	Through its security duty. What it requires
Belarus	Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40)	Through its security duty. What it requires
California	Customer Records Act, Reasonable Security Procedures	Through its security duty. What it requires
China	Data Security Law, Data Security Protection Obligations	Through its security duty. What it requires
Colorado	Protection of personal identifying information, reasonable security procedures duty	Through its security duty. What it requires
Connecticut	Connected device provider's duty to protect recorded personal information with reasonable security measures	Through its security duty. What it requires
Connecticut	Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty	Through its security duty. What it requires
Cuba	Decreto No. 360/2019 and its Reglamento de Seguridad de las TIC (Resolución 128/2019), TIC Security System duty	Through its security duty. What it requires
Delaware	Computer Security Breaches, protection of personal information	Through its security duty. What it requires

Show the other 23 laws

Democratic Republic of the Congo	Digital Code, Livre IV: Digital Services Provider Security Obligations	Through its security duty. What it requires
District of Columbia	Security requirements for personal information (Security Breach Protection Amendment Act of 2020)	Through its security duty. What it requires
Florida	Florida Information Protection Act, data security and disposal duty	Through its security duty. What it requires
Illinois	Personal Information Protection Act, data security duty	Through its security duty. What it requires
Indiana	Disclosure of Security Breach Act, data base owner's duty to maintain reasonable security procedures and dispose of records from a date not yet set	Through its security duty. What it requires
Kansas	Kansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information	Through its security duty. What it requires
Kazakhstan	Digital Code, general cybersecurity duty on digital-object owners and holders	Through its security duty. What it requires
Kuwait	Data Classification Policy	Through its security duty. What it requires
Louisiana	Database Security Breach Notification Law, reasonable security procedures and destruction duty	Through its security duty. What it requires
Maryland	Maryland Personal Information Protection Act (MPIPA), safeguards and secure-disposal duty	Through its security duty. What it requires
Massachusetts	Standards for the Protection of Personal Information of Residents of the Commonwealth	Through its security duty. What it requires
Mexico	Ley Federal de Protección al Consumidor, Electronic Transaction Security Duty (Arts. 76 Bis, 76 Bis 1)	Through its security duty. What it requires
Montenegro	Law on Information Security, General Security Measures	Through its security duty. What it requires
Nebraska	Financial Data Protection and Consumer Notification of Data Security Breach Act, security procedures and practices duty	Through its security duty. What it requires
Nevada	Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield from a date not yet set	Through its security duty. What it requires
Nevada	Security measures for data collectors maintaining personal information from a date not yet set	Through its security duty. What it requires
New Mexico	Data Breach Notification Act, security and disposal duties from a date not yet set	Through its security duty. What it requires
Oregon	Oregon Consumer Information Protection Act, requirement to develop safeguards for personal information	Through its security duty. What it requires
Rhode Island	Identity Theft Protection Act of 2015, risk-based information security program from a date not yet set	Through its security duty. What it requires
Texas	Identity Theft Enforcement and Protection Act, business duty to protect sensitive personal information	Through its security duty. What it requires
Turkmenistan	Law on Information and Its Protection, information-security duty	Through its security duty. What it requires
Utah	Protection of Personal Information Act, reasonable procedures and records-destruction duty	Through its security duty. What it requires
Vietnam	Cybersecurity Law, Information System Classification and Protection Measures	Through its security duty. What it requires

Sector security regimes

16 laws, 16 places

Place	Law	How it reaches this control
Angola	Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases	Through its security duty. What it requires
Burundi	Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers	Through its security duty. What it requires
Democratic Republic of the Congo	Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty	Through its security duty. What it requires
Djibouti	Digital Code, Book VI: Critical Installation Protection and Operator Security Controls	Through its security duty. What it requires
Ethiopia	Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations from 21 Jul 2027, in 9 months	Through its security duty. What it requires
Haiti	BRH Circulaire 126, Information Security Rules for Financial Institutions	Through its security duty. What it requires
Iceland	Minimum Risk-Management and Preparedness Requirements for Critical Infrastructure	Through its security duty. What it requires
Latvia	Nacionālās kiberdrošības likums, Cybersecurity Risk-Management Measures	Through its security duty. What it requires
Lebanon	Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts)	Through its security duty. What it requires
Liberia	Telecommunications Act 2007, Security Safeguards for Customer Information and Communications	Through its security duty. What it requires

Show the other 6 laws

Micronesia	FSM Telecommunications Act of 2014, Security Safeguards for Customer Information	Through its security duty. What it requires
Serbia	Law on Information Security, ICT Systems of Special Importance and Security Measures	Through its security duty. What it requires
Solomon Islands	Telecommunications Act 2009, Security Safeguards for Consumer Information	Through its security duty. What it requires
Taiwan	Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit	Through its security duty. What it requires
Tonga	Cybersecurity Act 2025, Critical Infrastructure Operator Obligations from a date not yet set	Through its security duty. What it requires
Turkmenistan	Law on Communications, network and subscriber-information protection duties	Through its security duty. What it requires

Product security requirements

8 laws, 8 places

Place	Law	How it reaches this control
Australia	Security Standards for Smart Devices	Through its security duty. What it requires
Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits	Through its security duty. What it requires
Brazil	Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment)	Through its security duty. What it requires
California	Security of Connected Devices	Through its security duty. What it requires
China	Cybersecurity Law, Network Product and Service Security Duties	Through its security duty. What it requires
Cyprus	Security of Networks and Information Systems Law, Radio Equipment Cybersecurity Requirements	Through its security duty. What it requires
Oregon	Security requirements for Internet-connected devices	Through its security duty. What it requires
United Kingdom	Product Security Requirements for Connectable Products	Through its security duty. What it requires

Vulnerability and incident reporting

8 laws, 8 places

Place	Law	How it reaches this control
Angola	Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties	Through its security duty. What it requires
China	Data Security Law, Risk Monitoring and Incident Reporting Duty	Through its security duty. What it requires
Latvia	Nacionālās kiberdrošības likums, Coordinated Vulnerability Disclosure and Remediation	Through its security duty. What it requires
Marshall Islands	Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations	Through its security duty. What it requires
Micronesia	FSM Cybersecurity Act 2025 (Bill), Critical Information Infrastructure Incident Reporting Clock proposed	Through its security duty. What it requires
Taiwan	Cyber Security Management Act, Cyber Security Incident Reporting	Through its security duty. What it requires
Tunisia	Cybersecurity Incident Reporting and Emergency Response	Through its security duty. What it requires
Vietnam	Cybersecurity Law, Incident Response and Reporting Duties	Through its security duty. What it requires

Sensitive categories

5 laws, 5 places

Place	Law	How it reaches this control
Angola	Law on the Protection of Personal Data, sensitive data categories	Through its security duty. What it requires
Cabo Verde	Law No. 133/V/2001 on the Protection of Personal Data, sensitive data categories	Through its security duty. What it requires
Morocco	Law No. 09-08, sensitive personal data and offense records	Through its security duty. What it requires
Rwanda	Law relating to the Protection of Personal Data and Privacy, sensitive personal data and children's data	Through its security duty. What it requires
Sao Tome and Principe	Lei n.º 03/2016, sensitive categories and suspect records	Through its security duty. What it requires

Cross border transfer

3 laws, 3 places

Place	Law	How it reaches this control
Cuba	Resolución 58/2022 (MINCOM), security and localization rules for personal data in electronic form	Through its security duty. What it requires
Niger	Loi n° 2022-59, transfert transfrontalier des données	Through its security duty. What it requires
United States	DOJ Data Security Program (Bulk Sensitive Personal Data Rule)	Through its security duty. What it requires

AI risk obligations

1 law, 1 place

Place	Law	How it reaches this control
European Union	AI Act, Article 15 (accuracy, robustness and cybersecurity) from 2 Dec 2027, in 14 months	Through its security duty. What it requires

Breach notification

1 law, 1 place

Place	Law	How it reaches this control
Samoa	National Digital Identification Act 2024, personal data breach notification	Through its security duty. What it requires

Enforcement supervision

1 law, 1 place

Place	Law	How it reaches this control
Zimbabwe	Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024	Through its security duty. What it requires

Full text of the FINOS AI Governance Framework, CC BY 4.0. FINOS AI Governance Framework, https://air-governance-framework.finos.org/, copyright 2025 FINOS, licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Titles and purpose text are quoted; markdown emphasis and links were removed. Every control of the framework.

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.