Law / Frameworks / Crosswalk / FINOS AIGF to OWASP Agentic Top 10

The FINOS AI Governance Framework, mapped to the OWASP Top 10 for Agentic Applications

16 of FINOS AIGF's controls connect to 4 of OWASP Agentic Top 10's through 247 laws in 130 jurisdictions. Two controls connect when the same duties, in at least 2 laws we track, reach both. The connections are our own reading of the law; no framework publisher has reviewed or endorsed them.

From: FINOS AI Governance Framework, version 2, as maintained on October 7, 2026, FINOS
To: OWASP Top 10 for Agentic Applications, 2026 edition, December 2025, OWASP GenAI Security Project
See also: OWASP Agentic Top 10 to FINOS AIGF, the other way · every pair in the crosswalk · law library as of 19 Oct 2026

Download this mapping, with every law behind each connection: owasp-agentic-top-10--finos-ai-governance-framework.csv · owasp-agentic-top-10--finos-ai-governance-framework.json

FINOS AIGF	OWASP Agentic Top 10	Laws	Jurisdictions	Where the laws stand
AIR-PREV-005System Acceptance Testing	ASI09Human-Agent Trust Exploitation	78	37	50 in force, 27 not yet in force, 1 proposed
AIR-PREV-005System Acceptance Testing	The 78 laws behind AIR-PREV-005 and ASI09 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
AIR-PREV-006Data Quality & Classification/Sensitivity	ASI09Human-Agent Trust Exploitation	78	37	50 in force, 27 not yet in force, 1 proposed
AIR-PREV-006Data Quality & Classification/Sensitivity	The 78 laws behind AIR-PREV-006 and ASI09 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
AIR-PREV-007Legal and Contractual Frameworks for AI Systems	ASI03Identity and Privilege Abuse	10	7	9 in force, 1 not yet in force
	The 10 laws behind AIR-PREV-007 and ASI03 Ordonnance n° 03-05, exception de citation, Algeria Copyright Act 2013, economic rights, computer program copying, and technological protection measures, Cook Islands AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Loi n°1/87, exception de courte citation et revue de presse, Gabon Loi n°1/87, protection des recueils et compilations, Gabon Schutz technischer Massnahmen und Durchsetzung von Schrankenbestimmungen (Protection of Technological Measures), Germany Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy Decreto-Lei n.º 02/2017, exclusão das notícias do dia, revista de imprensa e citação, Sao Tome and Principe Decreto-Lei n.º 02/2017, protecção de compilações e exclusão das notícias do dia, Sao Tome and Principe
	ASI01Agent Goal Hijack	3	2	2 in force, 1 not yet in force
	The 3 laws behind AIR-PREV-007 and ASI01 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	ASI04Agentic Supply Chain Vulnerabilities	3	2	2 in force, 1 not yet in force
	The 3 laws behind AIR-PREV-007 and ASI04 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	ASI09Human-Agent Trust Exploitation	2	2	2 in force
	The 2 laws behind AIR-PREV-007 and ASI09 Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems	ASI01Agent Goal Hijack	3	2	2 in force, 1 not yet in force
	The 3 laws behind AIR-PREV-008 and ASI01 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	ASI03Identity and Privilege Abuse	3	2	2 in force, 1 not yet in force
	The 3 laws behind AIR-PREV-008 and ASI03 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	ASI04Agentic Supply Chain Vulnerabilities	3	2	2 in force, 1 not yet in force
	The 3 laws behind AIR-PREV-008 and ASI04 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
AIR-PREV-012Role-Based Access Control for AI Data	ASI01Agent Goal Hijack	3	2	2 in force, 1 not yet in force
	The 3 laws behind AIR-PREV-012 and ASI01 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	ASI03Identity and Privilege Abuse	3	2	2 in force, 1 not yet in force
	The 3 laws behind AIR-PREV-012 and ASI03 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	ASI04Agentic Supply Chain Vulnerabilities	3	2	2 in force, 1 not yet in force
	The 3 laws behind AIR-PREV-012 and ASI04 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
AIR-PREV-014Encryption of AI Data at Rest	ASI01Agent Goal Hijack	3	2	2 in force, 1 not yet in force
	The 3 laws behind AIR-PREV-014 and ASI01 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	ASI03Identity and Privilege Abuse	3	2	2 in force, 1 not yet in force
	The 3 laws behind AIR-PREV-014 and ASI03 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	ASI04Agentic Supply Chain Vulnerabilities	3	2	2 in force, 1 not yet in force
	The 3 laws behind AIR-PREV-014 and ASI04 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
AIR-PREV-017AI Firewall Implementation and Management	ASI01Agent Goal Hijack FINOS maps these through risk AIR-SEC-010	3	2	2 in force, 1 not yet in force
	The 3 laws behind AIR-PREV-017 and ASI01 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	ASI03Identity and Privilege Abuse	3	2	2 in force, 1 not yet in force
	The 3 laws behind AIR-PREV-017 and ASI03 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	ASI04Agentic Supply Chain Vulnerabilities	3	2	2 in force, 1 not yet in force
	The 3 laws behind AIR-PREV-017 and ASI04 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
AIR-PREV-018Agent Authority Least Privilege Framework	ASI03Identity and Privilege Abuse FINOS maps these through risk AIR-SEC-024	145	107	142 in force, 3 not yet in force
AIR-PREV-018Agent Authority Least Privilege Framework	The 145 laws behind AIR-PREV-018 and ASI03 Penal Code, Part Twelve, Chapter One (Cyber Crimes and Punishment), Afghanistan Alabama Digital Crime Act, Computer Tampering, Alabama Criminal mischief in the fourth degree, unauthorized computer access, Alaska Criminal use of a computer, Alaska Theft of services, unauthorized use of a computer system, Alaska Copyright Law, Sui Generis Database Producers Rights, Albania Criminal Code, Unauthorized Computer Access, Albania Code pénal, atteintes aux systèmes de traitement automatisé de données, Algeria Ordonnance n° 03-05, exception de citation, Algeria Ordonnance n° 03-05, protection des bases de données, Algeria and 135 more, every one in the free file.
AIR-PREV-020MCP Server Security Governance	ASI01Agent Goal Hijack	3	2	2 in force, 1 not yet in force
	The 3 laws behind AIR-PREV-020 and ASI01 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	ASI03Identity and Privilege Abuse	3	2	2 in force, 1 not yet in force
	The 3 laws behind AIR-PREV-020 and ASI03 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	ASI04Agentic Supply Chain Vulnerabilities FINOS maps these through risk AIR-SEC-026	3	2	2 in force, 1 not yet in force
	The 3 laws behind AIR-PREV-020 and ASI04 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
AIR-PREV-023Agentic System Credential Protection Framework	ASI03Identity and Privilege Abuse FINOS maps these through risks AIR-SEC-024 and AIR-SEC-029	145	107	142 in force, 3 not yet in force
AIR-PREV-023Agentic System Credential Protection Framework	The 145 laws behind AIR-PREV-023 and ASI03 Penal Code, Part Twelve, Chapter One (Cyber Crimes and Punishment), Afghanistan Alabama Digital Crime Act, Computer Tampering, Alabama Criminal mischief in the fourth degree, unauthorized computer access, Alaska Criminal use of a computer, Alaska Theft of services, unauthorized use of a computer system, Alaska Copyright Law, Sui Generis Database Producers Rights, Albania Criminal Code, Unauthorized Computer Access, Albania Code pénal, atteintes aux systèmes de traitement automatisé de données, Algeria Ordonnance n° 03-05, exception de citation, Algeria Ordonnance n° 03-05, protection des bases de données, Algeria and 135 more, every one in the free file.
AIR-PREV-024Human-in-the-Loop Action Approval Gate	ASI09Human-Agent Trust Exploitation	78	37	50 in force, 27 not yet in force, 1 proposed
AIR-PREV-024Human-in-the-Loop Action Approval Gate	The 78 laws behind AIR-PREV-024 and ASI09 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
AIR-DET-001AI Data Leakage Prevention and Detection	ASI01Agent Goal Hijack	3	2	2 in force, 1 not yet in force
	The 3 laws behind AIR-DET-001 and ASI01 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	ASI03Identity and Privilege Abuse	3	2	2 in force, 1 not yet in force
	The 3 laws behind AIR-DET-001 and ASI03 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	ASI04Agentic Supply Chain Vulnerabilities	3	2	2 in force, 1 not yet in force
	The 3 laws behind AIR-DET-001 and ASI04 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
AIR-DET-004AI System Observability	ASI09Human-Agent Trust Exploitation	79	38	50 in force, 28 not yet in force, 1 proposed
AIR-DET-004AI System Observability	The 79 laws behind AIR-DET-004 and ASI09 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 69 more, every one in the free file.
AIR-DET-011Human Feedback Loop for AI Systems	ASI09Human-Agent Trust Exploitation	78	37	50 in force, 27 not yet in force, 1 proposed
AIR-DET-011Human Feedback Loop for AI Systems	The 78 laws behind AIR-DET-011 and ASI09 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
AIR-DET-013Providing Citations and Source Traceability for AI-Generated Information	ASI03Identity and Privilege Abuse	5	3	5 in force
	The 5 laws behind AIR-DET-013 and ASI03 Ordonnance n° 03-05, exception de citation, Algeria Loi n°1/87, exception de courte citation et revue de presse, Gabon Loi n°1/87, protection des recueils et compilations, Gabon Decreto-Lei n.º 02/2017, exclusão das notícias do dia, revista de imprensa e citação, Sao Tome and Principe Decreto-Lei n.º 02/2017, protecção de compilações e exclusão das notícias do dia, Sao Tome and Principe
AIR-DET-021Agent Decision Audit and Explainability	ASI09Human-Agent Trust Exploitation	101	46	64 in force, 32 not yet in force, 5 proposed
AIR-DET-021Agent Decision Audit and Explainability	The 101 laws behind AIR-DET-021 and ASI09 Distribution of Materially Deceptive Media to Influence an Upcoming Election, Alabama SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), California Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Synthetic Performer Advertising Disclosure Act (SB 1050), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada and 91 more, every one in the free file.

Not connected to the OWASP Agentic Top 10: 9 of FINOS AIGF's controls

No law we track reaches these

No duty in the laws we track reaches these controls.

AIR-PREV-002 Data Filtering From External Knowledge Bases
AIR-PREV-003 User/App/Model Firewalling/Filtering
AIR-PREV-010 AI Model Version Pinning
AIR-PREV-019 Tool Chain Validation and Sanitization
AIR-PREV-022 Multi-Agent Isolation and Segmentation
AIR-PREV-025 Skill/Plugin Integrity and Governance
AIR-DET-009 AI System Alerting and Denial of Wallet (DoW) / Spend Monitoring
AIR-DET-015 Using Large Language Models for Automated Evaluation (LLM-as-a-Judge)
AIR-DET-016 Preserving Source Data Access Controls in AI Systems

How these connections are drawn

Each requirement line in the laws we track is read against the framework for its subject (the AI, scraping and news aggregation laws against the NIST AI RMF, the privacy, communications and age assurance laws against the NIST Privacy Framework, the cybersecurity laws against the NIST CSF 2.0); laws on liability and content moderation are not read against any framework yet. A line reaches either framework through a kind of duty its law carries, and only where that kind of duty also reaches, on that same line, the NIST framework for the line's own subject. Two controls connect when lines in at least 2 laws reach both. That says the same duties reach both; it does not say the two are alike, or that running either one does what a law asks.

Every duty line in the AI, scraping and news aggregation laws we track has been read against the framework for its subject.

Sources and licenses

OWASP GenAI Security Project, Agentic Security Initiative, OWASP Top 10 for Agentic Applications 2026, licensed CC BY-SA 4.0. Excerpted: only the first paragraph of each entry's Description is reproduced, verbatim.