Law / Frameworks / FINOS AIGF / Preventative

FINOS AIGF AIR-PREV-024Human-in-the-Loop Action Approval Gate

A Human-in-the-Loop (HITL) Action Approval Gate is a preventive control that interrupts an agent immediately before it executes a designated high-risk action and holds execution until a human with the appropriate authority explicitly decides on the proposed action. Unlike privilege scoping (which governs what an agent may access) or feedback loops (which collect evaluative input for detection and improvement but do not themselves authorize the release of a particular action), the approval gate operates on the specific proposed action at the moment of execution, evaluating its resolved parameters and context against policy before any side effect occurs.FINOS AI Governance Framework, version 2, as maintained on October 7, 2026, AIR-PREV-024

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of 8 Oct 2026.

The kinds of duty that reach it: governance.

223: laws
132: places
0: with court rulings behind them
35: not yet in force
6: proposed, not law

The same ground elsewhere linked through the kinds of duty both controls are mapped from

NIST AI RMFGOVERN 1.1 Legal and regulatory requirements involving AI are understood, managed, and documented.
NIST AI RMFGOVERN 1.4 The risk management process and its outcomes are established through transparent...
NIST AI 600-1GAI-RISK-07 Human-AI Configuration
OWASP LLM Top 10LLM03:2026 Excessive Agency
OWASP Agentic Top 10ASI09 Human-Agent Trust Exploitation
MIT mitigations1.1 Board Structure & Oversight
MIT mitigations1.2 Risk Management
NIST Privacy FrameworkID.IM-P4 Data actions of the systems/products/services are inventoried.
NIST Privacy FrameworkGV.PO-P1 Organizational privacy values and policies (e.g., conditions on data processing such...
NIST CSF 2.0GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including...
NIST CSF 2.0GV.RR-01 Organizational leadership is responsible and accountable for cybersecurity risk and...
CIS Controls3.2 A maintained catalogue of the sensitive data the enterprise holds and where it sits.
CIS Controls8.2 Turning on and gathering logs from the enterprise's systems.

A law in force is unmarked; the rest wear their state: not yet in force proposed

Comprehensive regime

72 laws, 71 places

Place	Law	How it reaches this control
Albania	Law No. 124/2024 On the Protection of Personal Data	Through its governance duty. What it requires
Algeria	Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11	Through its governance duty. What it requires
Andorra	LQPD, Llei 29/2021 del 28 d'octubre	Through its governance duty. What it requires
Argentina	Ley 25.326, Ley de Protección de los Datos Personales	Through its governance duty. What it requires
Barbados	Data Protection Act, 2019	Through its governance duty. What it requires
Belarus	Law of the Republic of Belarus On Personal Data Protection	Through its governance duty. What it requires
Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel)	Through its governance duty. What it requires
Bosnia and Herzegovina	Law on the Protection of Personal Data of Bosnia and Herzegovina	Through its governance duty. What it requires
Botswana	Data Protection Act, 2024 (Act No. 18 of 2024)	Through its governance duty. What it requires
Brazil	Lei Geral de Proteção de Dados Pessoais (LGPD)	Through its governance duty. What it requires

Show the other 62 laws

Burkina Faso	Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel	Through its governance duty. What it requires
Cambodia	Draft Law on Personal Data Protection, final draft proposed	Through its governance duty. What it requires
Cameroon	Loi n°2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun from a date not yet set	Through its governance duty. What it requires
Central African Republic	Loi n° 24.001 portant protection des données à caractère personnel	Through its governance duty. What it requires
Colombia	Ley 1581 de 2012, General Personal Data Protection	Through its governance duty. What it requires
Comoros	Law on the Protection of Personal Data	Through its governance duty. What it requires
Côte d'Ivoire	Law No. 2013-450 on the Protection of Personal Data	Through its governance duty. What it requires
Democratic Republic of the Congo	Digital Code, Title III: Personal Data Protection	Through its governance duty. What it requires
Djibouti	Digital Code, Book I: Personal Data Protection and CNDP	Through its governance duty. What it requires
Dominican Republic	Ley No. 172-13 sobre Protección Integral de los Datos Personales	Through its governance duty. What it requires
Ecuador	LOPDP, comprehensive personal-data protection regime	Through its governance duty. What it requires
Egypt	Law No. 151 of 2020 Promulgating the Personal Data Protection Law	Through its governance duty. What it requires
El Salvador	Ley para la Protección de Datos Personales	Through its governance duty. What it requires
Eswatini	Data Protection Act, 2022 (Act No. 5 of 2022)	Through its governance duty. What it requires
Ethiopia	Personal Data Protection Proclamation	Through its governance duty. What it requires
European Union	General Data Protection Regulation (GDPR), Comprehensive Regime	Through its governance duty. What it requires
Gabon	Loi n°001/2011 relative à la protection des données à caractère personnel, modifiée par la loi n°025/2023	Through its governance duty. What it requires
Gambia	Personal Data Protection and Privacy Act, 2025 from a date not yet set	Through its governance duty. What it requires
Grenada	Data Protection Act, No. 1 of 2023 from a date not yet set	Through its governance duty. What it requires
Jamaica	Data Protection Act, 2020, registration, lawful basis and standards for processing	Through its governance duty. What it requires
Kosovo	Law No. 06/L-082 on Protection of Personal Data	Through its governance duty. What it requires
Lebanon	Law No. 81/2018 on Electronic Transactions and Personal Data, Part V (Personal Data Protection)	Through its governance duty. What it requires
Lesotho	Data Protection Act, 2011 (Act No. 5 of 2012)	Through its governance duty. What it requires
Liberia	Telecommunications Act of 2007, Protection of Personal Information (§§ 51-52)	Through its governance duty. What it requires
Madagascar	Law No. 2014-038, protection of personal data	Through its governance duty. What it requires
Maldives	Personal Data Protection Bill, pending before the People's Majlis proposed	Through its governance duty. What it requires
Mali	Loi n° 2013-015, protection des données à caractère personnel	Through its governance duty. What it requires
Marshall Islands	Personal Data Protection Act 2025, government personal-data protection principles	Through its governance duty. What it requires
Mauritania	Loi n° 2017-020, protection des données à caractère personnel	Through its governance duty. What it requires
Mexico	Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP)	Through its governance duty. What it requires
Moldova	Law No. 195/2024 on Personal Data Protection	Through its governance duty. What it requires
Monaco	Loi sur la Protection des Données Personnelles	Through its governance duty. What it requires
Montenegro	Law on Personal Data Protection from a date not yet set	Through its governance duty. What it requires
Morocco	Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data	Through its governance duty. What it requires
Mozambique	Electronic Transactions Law, Protection of Personal Electronic Data	Through its governance duty. What it requires
Nicaragua	Ley No. 787, Ley de Protección de Datos Personales	Through its governance duty. What it requires
Niger	Loi n° 2022-59, protection des données à caractère personnel	Through its governance duty. What it requires
Nigeria	Nigeria Data Protection Act, 2023 (NDPA), general data protection duties	Through its governance duty. What it requires
North Macedonia	Law on Personal Data Protection (LPDP)	Through its governance duty. What it requires
Panama	Ley 81 de 2019, Sobre Protección de Datos Personales	Through its governance duty. What it requires
Paraguay	Ley N° 7593/2025, de Protección de Datos Personales en la República del Paraguay from 27 Nov 2027, in 14 months	Through its governance duty. What it requires
Peru	Ley 29733, Ley de Protección de Datos Personales	Through its governance duty. What it requires
Republic of the Congo	Law No. 29-2019 on the Protection of Personal Data	Through its governance duty. What it requires
Rwanda	Law relating to the Protection of Personal Data and Privacy	Through its governance duty. What it requires
San Marino	San Marino Law No. 171 on the Protection of Natural Persons	Through its governance duty. What it requires
Sao Tome and Principe	Lei n.º 03/2016, Protecção de Dados Pessoais	Through its governance duty. What it requires
Senegal	Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel (Personal Data Protection Act)	Through its governance duty. What it requires
Serbia	Law on Personal Data Protection	Through its governance duty. What it requires
Somalia	Data Protection Act No. 005 of 2023	Through its governance duty. What it requires
South Africa	Protection of Personal Information Act 4 of 2013 (POPIA)	Through its governance duty. What it requires
Suriname	Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens) proposed	Through its governance duty. What it requires
Syria	Law No. 12 of 2024 on Protection of Electronic Personal Data	Through its governance duty. What it requires
Togo	Loi n° 2019-014, protection des données à caractère personnel	Through its governance duty. What it requires
Trinidad and Tobago	Data Protection Act, 2011	Through its governance duty. What it requires
Tunisia	Organic Act on the Protection of Personal Data	Through its governance duty. What it requires
Uganda	Data Protection and Privacy Act, 2019, comprehensive personal-data regime	Through its governance duty. What it requires
Ukraine	Draft Law No. 8153 on Personal Data Protection (GDPR-Aligned Reform) proposed	Through its governance duty. What it requires
Ukraine	Law of Ukraine On the Protection of Personal Data	Through its governance duty. What it requires
Uruguay	Ley N° 18.331, Personal Data Protection and Habeas Data Law, as amended	Through its governance duty. What it requires
Vatican City	General Regulation on the Protection of Personal Data for Vatican City State	Through its governance duty. What it requires
Zambia	Data Protection Act, 2021, personal data processing framework	Through its governance duty. What it requires
Zimbabwe	Cyber and Data Protection Act [Chapter 12:07]	Through its governance duty. What it requires

Enforcement supervision

64 laws, 64 places

Place	Law	How it reaches this control
Albania	Law No. 124/2024, Commissioner, remedies, liability and penalties	Through its governance duty. What it requires
Algeria	Loi n° 18-07 relative à la protection des personnes physiques, contrôle, sanctions et voies de recours	Through its governance duty. What it requires
Andorra	LQPD, the Andorran Data Protection Agency, its powers, infractions and sanctions	Through its governance duty. What it requires
Angola	Law on the Protection of Personal Data, enforcement and supervision	Through its governance duty. What it requires
Antigua and Barbuda	Data Protection Act, 2013, information commissioner and enforcement	Through its governance duty. What it requires
Argentina	Ley 25.326, enforcement, sanctions, and the habeas data action	Through its governance duty. What it requires
Bahamas	Data Protection Act 2003, Commissioner, enforcement and penalties	Through its governance duty. What it requires
Barbados	Data Protection Act, 2019, the Commissioner, enforcement and penalties	Through its governance duty. What it requires
Belarus	Law of the Republic of Belarus On Personal Data Protection, authorized agency and liability	Through its governance duty. What it requires
Belize	Data Protection Act 2021, Commissioner, Tribunal, and enforcement from a date not yet set	Through its governance duty. What it requires

Show the other 54 laws

Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, Autorité de Protection des Données Personnelles, sanctions et infractions pénales	Through its governance duty. What it requires
Bermuda	Personal Information Protection Act 2016, Commissioner, enforcement and offences	Through its governance duty. What it requires
Bosnia and Herzegovina	Law on the Protection of Personal Data of Bosnia and Herzegovina, the Agency, enforcement and penalties	Through its governance duty. What it requires
Brazil	LGPD, civil liability, administrative sanctions and the ANPD	Through its governance duty. What it requires
Burkina Faso	Personal Data Protection Law, supervisory authority and sanctions	Through its governance duty. What it requires
Cabo Verde	Law No. 133/V/2001 on the Protection of Personal Data, enforcement and supervision	Through its governance duty. What it requires
Cayman Islands	Data Protection Act 2021 Revision, Ombudsman enforcement, monetary penalties and offences	Through its governance duty. What it requires
Chad	Loi n°007/PR/2015, sanctions administratives et pénales et recours	Through its governance duty. What it requires
China	Personal Information Protection Law, Supervision and Legal Liability	Through its governance duty. What it requires
Colombia	SIC Circular on AI, Demonstrated Accountability	Through its governance duty. What it requires
Comoros	Law on the Protection of Personal Data, the Commission and sanctions	Through its governance duty. What it requires
Côte d'Ivoire	Law No. 2013-450 on the Protection of Personal Data, enforcement and the Protection Body	Through its governance duty. What it requires
Democratic Republic of the Congo	Digital Code, Data Protection Authority and sanctions	Through its governance duty. What it requires
Djibouti	Digital Code, Book I: the Commission, administrative sanctions and criminal offences	Through its governance duty. What it requires
Egypt	Egypt Personal Data Protection Law, the Center, judicial control and penalties	Through its governance duty. What it requires
Eswatini	Data Protection Act, 2022, enforcement and offences	Through its governance duty. What it requires
Ethiopia	Personal Data Protection Proclamation, enforcement, sanctions and offences	Through its governance duty. What it requires
Gabon	Law No. 025/2023, recourse, oversight and sanctions	Through its governance duty. What it requires
Gambia	Personal Data Protection and Privacy Act, 2025, the Information Commission, offences and penalties from a date not yet set	Through its governance duty. What it requires
Ghana	Data Protection Act, enforcement, offences and penalties	Through its governance duty. What it requires
Grenada	Data Protection Act, No. 1 of 2023, Information Commission, enforcement and offences from a date not yet set	Through its governance duty. What it requires
Idaho	Student Data Accessibility, Transparency and Accountability Act (SDATAA) from a date not yet set	Through its governance duty. What it requires
Kiribati	Data Protection Act 2025, enforcement, offences and civil remedies from a date not yet set	Through its governance duty. What it requires
Kosovo	Law No. 06/L-082 on Protection of Personal Data, remedies, the Agency, inspections and penalties	Through its governance duty. What it requires
Lesotho	Data Protection Act, 2011, enforcement and offences	Through its governance duty. What it requires
Libya	Law No. 6 of 2022, supervisory authority, licensing and penalties	Through its governance duty. What it requires
Madagascar	Law No. 2014-038, CMIL, sanctions and offences	Through its governance duty. What it requires
Mali	Loi n° 2013-015, the Autorité, supervision, and sanctions	Through its governance duty. What it requires
Marshall Islands	Personal Data Protection Act 2025, competent authority, remedies, and complaints	Through its governance duty. What it requires
Mauritania	Loi n° 2017-020, Autorité de Protection des Données et sanctions	Through its governance duty. What it requires
Moldova	Moldova Law No. 195/2024, the Centre, complaints, compensation and sanctions	Through its governance duty. What it requires
Monaco	Loi sur la Protection des Données Personnelles, autorité de contrôle et sanctions	Through its governance duty. What it requires
Montenegro	Law on Personal Data Protection, agency, supervision and penal provisions from a date not yet set	Through its governance duty. What it requires
Morocco	Law No. 09-08, the CNDP and sanctions	Through its governance duty. What it requires
Nicaragua	Ley No. 787, Ley de Protección de Datos Personales, supervision, sanctions, and complaints	Through its governance duty. What it requires
Niger	Loi n° 2022-59, contrôle, sanctions et recours	Through its governance duty. What it requires
Nigeria	Nigeria Data Protection Act, 2023, complaints, enforcement and redress	Through its governance duty. What it requires
North Macedonia	Law on Personal Data Protection (LPDP), the Agency, supervision and misdemeanour provisions	Through its governance duty. What it requires
Panama	Ley 81 de 2019, enforcement and sanctions	Through its governance duty. What it requires
Peru	Ley 29733, enforcement, supervisory authority and sanctions	Through its governance duty. What it requires
Rwanda	Law relating to the Protection of Personal Data and Privacy, supervisory authority, penalties and offences	Through its governance duty. What it requires
Saint Kitts and Nevis	Data Protection Act, 2018, Information Commissioner, enforcement and offences from a date not yet set	Through its governance duty. What it requires
San Marino	San Marino Law No. 171, the Data Protection Authority, remedies and fines	Through its governance duty. What it requires
Senegal	Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel, Commission des Données Personnelles et sanctions	Through its governance duty. What it requires
Somalia	Data Protection Act, 2023, complaints, orders of the Authority and civil remedies	Through its governance duty. What it requires
South Africa	Protection of Personal Information Act, the Information Regulator, enforcement and penalties	Through its governance duty. What it requires
Suriname	Draft Law on the Protection of Privacy and Personal Data, Commissioner, remedies and fines proposed	Through its governance duty. What it requires
Syria	Law No. 12 of 2024 on Protection of Electronic Personal Data, Authority, complaints and penalties	Through its governance duty. What it requires
Togo	Loi n° 2019-014, cadre institutionnel et dispositions pénales	Through its governance duty. What it requires
Tonga	Privacy Act 2025, penalties, enforcement and third party actions from a date not yet set	Through its governance duty. What it requires
Trinidad and Tobago	Data Protection Act, 2011, Commissioner, contravention and enforcement	Through its governance duty. What it requires
Tunisia	Organic Act on the Protection of Personal Data, enforcement and sanctions	Through its governance duty. What it requires
Vanuatu	Data Protection and Privacy Act 2024, enforcement powers and offences	Through its governance duty. What it requires
Zimbabwe	Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024	Through its governance duty. What it requires

Sector security regimes

40 laws, 38 places

Place	Law	How it reaches this control
Albania	Law No. 25/2024, On Cybersecurity	Through its governance duty. What it requires
Andorra	Llei 22/2022, Cybersecurity Risk-Management Obligations	Through its governance duty. What it requires
Austria	Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures	Through its governance duty. What it requires
Belgium	Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance	Through its governance duty. What it requires
Bulgaria	Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS)	Through its governance duty. What it requires
Croatia	Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance	Through its governance duty. What it requires
Cyprus	Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance	Through its governance duty. What it requires
Czech Republic	Cybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures	Through its governance duty. What it requires
Denmark	NIS 2-loven, Cybersecurity Risk-Management Measures and Registration	Through its governance duty. What it requires
Estonia	Küberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties	Through its governance duty. What it requires

Show the other 30 laws

Ethiopia	Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations from 21 Jul 2027, in 9 months	Through its governance duty. What it requires
European Union	NIS2 Directive, Cybersecurity Risk-Management Measures	Through its governance duty. What it requires
Finland	Kyberturvallisuuslaki, Cybersecurity Risk-Management Measures and Governance	Through its governance duty. What it requires
Germany	BSI-Gesetz (BSIG), Risk-Management Measures for Essential and Important Entities	Through its governance duty. What it requires
Greece	Law 5160/2024, Cybersecurity Risk-Management Measures and Governance	Through its governance duty. What it requires
Haiti	BRH Circulaire 126, Information Security Rules for Financial Institutions	Through its governance duty. What it requires
Hungary	Cybersecurity Act, Risk-Management Measures	Through its governance duty. What it requires
Iceland	Minimum Risk-Management and Preparedness Requirements for Critical Infrastructure	Through its governance duty. What it requires
Italy	Decreto Legislativo 4 settembre 2024, n. 138 (Decreto NIS2), Risk-Management Measures	Through its governance duty. What it requires
Kiribati	Cybersecurity Act 2026, Critical Infrastructure Operator Obligations from a date not yet set	Through its governance duty. What it requires
Liechtenstein	Cyber-Sicherheitsgesetz (CSG), Risk-Management Measures for Essential and Important Entities	Through its governance duty. What it requires
Lithuania	Kibernetinio saugumo įstatymas (Law on Cyber Security), Risk-Management Measures	Through its governance duty. What it requires
Luxembourg	Loi du 5 mai 2026 relative à la cybersécurité (NIS2), Risk-Management Measures for Essential and Important Entities	Through its governance duty. What it requires
Malta	Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, Risk-Management Measures for Essential and Important Entities	Through its governance duty. What it requires
Marshall Islands	Cybersecurity Act 2025, Cybersecurity of Critical Information Infrastructure	Through its governance duty. What it requires
Montenegro	Law on Information Security, Essential and Important Entities	Through its governance duty. What it requires
Mozambique	Cybersecurity Law, Sector-Specific Security Requirements for Critical Infrastructure, Essential Services and Digital Providers	Through its governance duty. What it requires
Netherlands	Cyberbeveiligingswet, Cybersecurity Risk-Management Measures and Governance	Through its governance duty. What it requires
Portugal	Regime Jurídico da Cibersegurança, Cybersecurity Risk-Management Measures and Governance	Through its governance duty. What it requires
Romania	Ordonanța de urgență nr. 155/2024, Cybersecurity Risk-Management Measures	Through its governance duty. What it requires
Serbia	Law on Information Security, ICT Systems of Special Importance and Security Measures	Through its governance duty. What it requires
Sierra Leone	Cyber Security and Crime Act, 2021, Critical National Information Infrastructure	Through its governance duty. What it requires
Slovakia	Zákon o kybernetickej bezpečnosti (Cybersecurity Act), Risk-Management Measures	Through its governance duty. What it requires
Slovenia	Zakon o informacijski varnosti (ZInfV-1), Cybersecurity Risk-Management Measures and Governance from 19 Dec 2026, in 2 months	Through its governance duty. What it requires
Spain	Real Decreto-ley 12/2018, Security Obligations for Operators of Essential Services and Digital Service Providers	Through its governance duty. What it requires
Sweden	Cybersäkerhetslag, Cybersecurity Risk-Management Measures	Through its governance duty. What it requires
Taiwan	Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit	Through its governance duty. What it requires
Taiwan	Cyber Security Management Act, Specific Non-Government Agency Cyber Security Management	Through its governance duty. What it requires
Taiwan	Telecommunications Management Act, Cyber Security and Critical Infrastructure Protection Plans	Through its governance duty. What it requires
Tonga	Cybersecurity Act 2025, Critical Infrastructure Operator Obligations from a date not yet set	Through its governance duty. What it requires

AI risk obligations

14 laws, 8 places

Place	Law	How it reaches this control
El Salvador	Resolución ANIA 0001/2025, registro obligatorio para decisiones consecuenciales	Through its governance duty. What it requires
European Union	AI Act, Article 10 (data and data governance) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 111(2) (2030 compliance deadline for public-authority-intended systems) from 2 Aug 2030, in 3.8 years	Through its governance duty. What it requires
European Union	AI Act, Article 14 (human oversight) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 26(10) (post-remote biometric identification authorisation) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 6(3) and (4) (narrow-task derogation from Annex III high-risk classification) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 9 (risk management system) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
Indiana	Downcoding of Health Benefits Claims, automated and AI decision-making (House Enrolled Act 1271, 2026)	Through its governance duty. What it requires
Kyrgyzstan	Digital Code, Chapter 23: AI system design and risk-management obligations	Through its governance duty. What it requires

Show the other 4 laws

Malta	Artificial Intelligence (Designation of the Information and Data Protection Commissioner for the purposes of Regulation (EU) 2024/1689) Regulations, 2025 (L.N. 227 of 2025)	Through its governance duty. What it requires
Montana	Right to Compute Act (SB 212, 2025), critical AI infrastructure risk management duty	Through its governance duty. What it requires
South Korea	AI Framework Act, Article 34 (business-operator duties for high-impact AI)	Through its governance duty. What it requires
Vietnam	Law on Artificial Intelligence, risk classification and conformity assessment	Through its governance duty. What it requires

AI governance

10 laws, 7 places

Place	Law	How it reaches this control
California	Transparency in Frontier Artificial Intelligence Act (SB 53)	Through its governance duty. What it requires
European Union	AI Act, Article 12 (record-keeping) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 19 (automatically generated logs) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 21(2) (competent authority access to automatically generated logs) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 26(6) (deployer log-keeping) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
Germany	Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act	Through its governance duty. What it requires
Illinois	Artificial Intelligence Safety Measures Act from 1 Jan 2027, in 3 months	Through its governance duty. What it requires
Russia	Federal Law No. 243-FZ, Article 8, Duties of Sovereign and National Foundation Model Developers from 1 Mar 2027, in 5 months	Through its governance duty. What it requires
Vanuatu	Digital Transformation Act 2025, ICT service permit for AI and AI-related data services	Through its governance duty. What it requires
Vatican City	Guidelines on Artificial Intelligence of Vatican City State (Decree No. DCCII)	Through its governance duty. What it requires

Security baseline statutes

9 laws, 9 places

Place	Law	How it reaches this control
Cameroon	Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC)	Through its governance duty. What it requires
China	Data Security Law, Data Security Protection Obligations	Through its governance duty. What it requires
Gabon	Sécurité des systèmes d'information (dispositions communes)	Through its governance duty. What it requires
Kuwait	Data Classification Policy	Through its governance duty. What it requires
Kyrgyzstan	Digital Code, digital resilience baseline security measures	Through its governance duty. What it requires
Montenegro	Law on Information Security, General Security Measures	Through its governance duty. What it requires
Mozambique	Cybersecurity Law, General Security Requirements for the Public Administration and the Private Sector	Through its governance duty. What it requires
Peru	Proyecto de Ley 9906/2024-CR, Ley de Seguridad Digital o Ciberseguridad proposed	Through its governance duty. What it requires
Vietnam	Cybersecurity Law, Information System Classification and Protection Measures	Through its governance duty. What it requires

AI sector rules

7 laws, 7 places

Place	Law	How it reaches this control
Alabama	SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization	Through its governance duty. What it requires
Colorado	Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models	Through its governance duty. What it requires
Georgia	Private Review Agent Artificial Intelligence Coverage Determinations Act (SB 444) from 1 Jan 2027, in 3 months	Through its governance duty. What it requires
Maine	Use of artificial intelligence in therapy or psychotherapy services from a date not yet set	Through its governance duty. What it requires
Minnesota	Utilization Review, AI-Only Adverse Determination Prohibition from 1 Jan 2027, in 3 months	Through its governance duty. What it requires
Nevada	AB 406 (2025), licensed provider restriction on direct clinical use of AI	Through its governance duty. What it requires
Utah	Health Insurance Preauthorization AI Disclosure (SB 319, 2026 General Session) from 1 Jan 2027, in 3 months	Through its governance duty. What it requires

Product security requirements

2 laws, 2 places

Place	Law	How it reaches this control
Australia	Security Standards for Smart Devices	Through its governance duty. What it requires
China	Cybersecurity Law, Network Product and Service Security Duties	Through its governance duty. What it requires

AI prohibited practices

1 law, 1 place

Place	Law	How it reaches this control
Denmark	Lov nr. 467 af 14. maj 2025, National Competent Authorities and Article 5 Enforcement	Through its governance duty. What it requires

AI training data

1 law, 1 place

Place	Law	How it reaches this control
European Union	AI Act, Article 53 (obligations for providers of general-purpose AI models)	Through its governance duty. What it requires

AI transparency

1 law, 1 place

Place	Law	How it reaches this control
Jamaica	Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings	Through its governance duty. What it requires

Data subject rights

1 law, 1 place

Place	Law	How it reaches this control
Ecuador	SPDP Norma General guaranteeing personal-data protection in the use of AI systems from a date not yet set	Through its governance duty. What it requires

Sensitive categories

1 law, 1 place

Place	Law	How it reaches this control
Gabon	Law No. 025/2023, sensitive categories of personal data and children's data	Through its governance duty. What it requires

Full text of the FINOS AI Governance Framework, CC BY 4.0. FINOS AI Governance Framework, https://air-governance-framework.finos.org/, copyright 2025 FINOS, licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Titles and purpose text are quoted; markdown emphasis and links were removed. Every control of the framework.

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.