LexLint.ioBeta

Know the law your code answers to.

Law / Frameworks / MIT mitigations

MIT AI Risk Mitigation Taxonomy

Below are its 23 controls in the framework's own order, and under each one the laws we track that bear on it. Each mapping is our reading that a law bears on a control, never a finding that running the control meets the law.

Draft MIT AI Risk Initiative released this edition as a draft, and the final edition may differ. We check its page every week, and a new edition is read against the law again. Every draft we track

Where the law lands in the framework

18of 23 controls have law557laws198jurisdictions

1.1: 77 laws in 36 jurisdictions1.2: 87 laws in 40 jurisdictions1.3: no law we track1.4: no law we track1.5: 195 laws in 112 jurisdictions1.5 1951.6: no law we track1.7: 14 laws in 12 jurisdictions2.1: 152 laws in 113 jurisdictions2.2: no law we track2.3: 8 laws in 7 jurisdictions2.4: 55 laws in 41 jurisdictions3.1: 18 laws in 13 jurisdictions3.2: 214 laws in 131 jurisdictions3.2 2143.3: 201 laws in 113 jurisdictions3.4: no law we track3.5: 77 laws in 36 jurisdictions3.6: 5 laws in 4 jurisdictions4.1: 165 laws in 82 jurisdictions4.1 1654.2: 104 laws in 62 jurisdictions4.3: 26 laws in 16 jurisdictions4.4: 4 laws in 3 jurisdictions4.5: 25 laws in 16 jurisdictions4.6: 108 laws in 66 jurisdictions1234

Of these laws, 465 are in force, 68 not yet in force, 2 blocked by a court, and 22 proposed and not law.

3 of the 7 controls under Governance & Oversight Controls have no law we track under them.

  • in force
  • not yet in force
  • blocked by a court
  • proposed
  • no law we track
A bar's height is its number of laws. Select one to open the control.

Read through the kinds of duty each AI, scraping and news aggregation law we track carries, counting a kind of duty only where the law's own requirement lines, as read against the NIST AI Risk Management Framework, bear it out.

Governance & Oversight Controls

4 of 7 controls with law

Formal organizational structures and policy frameworks that establish human oversight mechanisms and decision protocols to ensure human accountability, ethical conduct, and risk management throughout AI development and deployment.

ControlWhat it saysLaws, by stateLawsJurisdictionsNot yet in forceBlockedProposed
1.1 Board Structure & Oversight 77 laws, 27 not yet in force, 1 proposed 77 36 27 0 1
1.2 Risk Management 87 laws, 29 not yet in force, 7 proposed 87 40 29 0 7
1.3 Conflict of Interest Protections no law we track no law we track
1.4 Whistleblower Reporting & Protection no law we track no law we track
1.5 Safety Decision Frameworks 195 laws, 15 not yet in force, 2 blocked, 8 proposed 195 112 15 2 8
1.6 Environmental Impact Management no law we track no law we track
1.7 Societal Impact Assessment 14 laws, 2 not yet in force, 6 proposed 14 12 2 0 6

Technical & Security Controls

3 of 4 controls with law

Technical, physical, and engineering safeguards that secure AI systems and constrain model behaviors to ensure security, safety, alignment with human values, and content integrity.

ControlWhat it saysLaws, by stateLawsJurisdictionsNot yet in forceBlockedProposed
2.1 Model & Infrastructure Security 152 laws, 3 not yet in force, 1 proposed 152 113 3 0 1
2.2 Model Alignment no law we track no law we track
2.3 Model Safety Engineering 8 laws, 4 not yet in force, 1 proposed 8 7 4 0 1
2.4 Content Safety Controls 55 laws, 12 not yet in force, 1 blocked, 4 proposed 55 41 12 1 4

Operational Process Controls

5 of 6 controls with law

Processes and management frameworks governing AI system deployment, usage, monitoring, incident handling, and validation, which promote safety, security, and accountability throughout the system lifecycle.

ControlWhat it saysLaws, by stateLawsJurisdictionsNot yet in forceBlockedProposed
3.1 Testing & Auditing 18 laws, 3 not yet in force, 7 proposed 18 13 3 0 7
3.2 Data Governance 214 laws, 9 not yet in force, 2 proposed 214 131 9 0 2
3.3 Access Management 201 laws, 18 not yet in force, 2 blocked, 8 proposed 201 113 18 2 8
3.4 Staged Deployment no law we track no law we track
3.5 Post-deployment Monitoring 77 laws, 27 not yet in force, 1 proposed 77 36 27 0 1
3.6 Incident Response & Recovery 5 laws, 1 not yet in force, 1 proposed 5 4 1 0 1

Transparency & Accountability Controls

6 of 6 controls with law

Formal disclosure practices and verification mechanisms that communicate AI system information and enable external scrutiny to build trust, facilitate oversight, and ensure accountability to users, regulators, and the public.

ControlWhat it saysLaws, by stateLawsJurisdictionsNot yet in forceBlockedProposed
4.1 System Documentation 165 laws, 44 not yet in force, 15 proposed 165 82 44 0 15
4.2 Risk Disclosure 104 laws, 26 not yet in force, 15 proposed 104 62 26 0 15
4.3 Incident Reporting 26 laws, 7 not yet in force, 1 proposed 26 16 7 0 1
4.4 Governance Disclosure 4 laws, 2 not yet in force 4 3 2 0 0
4.5 Third-Party System Access 25 laws, 7 not yet in force, 1 proposed 25 16 7 0 1
4.6 User Rights & Recourse 108 laws, 24 not yet in force, 1 blocked, 14 proposed 108 66 24 1 14

Where the law and the framework part

5 of the 23 controls have no law we track under them.

The framework's text

Full text of the MIT AI Risk Mitigation Taxonomy, CC BY 4.0. MIT AI Risk Initiative (MIT FutureTech), AI Risk Mitigation Taxonomy. Data from the MIT AI Risk Initiative is licensed under CC BY 4.0. Cite as: Mapping AI Risk Mitigations: Evidence Scan & Draft Mitigation Taxonomy

Read it from the publisher: airisk.mit.edu