LexLint.ioBeta

Know the law your code answers to.

Law / Frameworks / MIT mitigations Draft / Governance & Oversight Controls

MIT mitigations 1.2Risk Management

Systematic methods that identify, evaluate, and manage AI risks for comprehensive risk governance across organizations.MIT AI Risk Mitigation Taxonomy, preliminary taxonomy, July 2025, 1.2

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of .

The kinds of duty that reach it: DPIA, governance.

87
laws
40
jurisdictions
0
with court rulings behind them
29
not yet in force
7
proposed, not law

Related controls in other frameworks the same duties, in at least two laws we track, reach both

A law in force is unmarked; the rest wear their state: not yet in force proposed

  • Alabama
  • Andorra
  • Armenia
  • California
  • Canada
  • Colorado
  • Denmark
  • El Salvador
  • European Union
  • Finland
  • Georgia
  • Germany
  • Hungary
  • Illinois
  • Indiana
  • Italy
  • Jamaica
  • Jordan
  • Kyrgyzstan
  • Latvia
  • Malta
  • Mauritius
  • Michigan
  • Minnesota
  • Moldova
  • Montana
  • Nevada
  • New Jersey
  • Poland
  • Russia
  • Saudi Arabia
  • Slovenia
  • South Korea
  • United Arab Emirates
  • United Kingdom
  • United States
  • Utah
  • Vanuatu
  • Vatican City
  • Vietnam

AI governance

28 laws, 20 jurisdictions
JurisdictionLawHow it reaches this control
Andorra Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra proposed

Through its DPIA duty. What it requires
Armenia Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia proposed

Through its DPIA duty. What it requires
California Transparency in Frontier Artificial Intelligence Act (SB 53)

Through its governance duty. What it requires
Canada Council of Europe Framework Convention on Artificial Intelligence, signed by Canada proposed

Through its DPIA duty. What it requires
El Salvador Ley de Fomento a la Inteligencia Artificial y Tecnologías, marco institucional, registro y evaluación de riesgos

Through its DPIA duty. What it requires
European Union AI Act, Article 12 (record-keeping) from , in 13 months

Through its governance duty. What it requires
European Union AI Act, Article 18 (documentation keeping) from , in 13 months

Through its governance duty. What it requires
European Union AI Act, Article 19 (automatically generated logs) from , in 13 months

Through its governance duty. What it requires
European Union AI Act, Article 21(2) (competent authority access to automatically generated logs) from , in 13 months

Through its governance duty. What it requires
European Union AI Act, Article 22(3), points (b) and (c) (authorised representative: documents held for 10 years and access to logs) from , in 13 months

Through its governance duty. What it requires
Show the other 18 laws
European Union AI Act, Article 26(6) (deployer log-keeping) from , in 13 months

Through its governance duty. What it requires
European Union AI Act, Article 26(9) (using Article 13 information for a data protection impact assessment) from , in 13 months

Through its DPIA duty. What it requires
European Union Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act

Through its governance duty. What it requires
Finland Laki eräiden tekoälyjärjestelmien valvonnasta, Act on the Supervision of Certain Artificial Intelligence Systems

Through its governance duty. What it requires
Germany Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act

Through its governance duty. What it requires
Hungary Act LXXV of 2025 on the Domestic Implementation of the EU AI Regulation

Through its governance duty. What it requires
Hungary Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings

Through its governance duty. What it requires
Illinois Artificial Intelligence Safety Measures Act from , in 7 weeks

Through its governance duty. What it requires
Latvia Law on Digital Operational Resilience of the Financial Market and the Use of Artificial Intelligence, Articles 7, 8(5)-(7), 10(3)-(4) and 11(2)

Through its governance duty. What it requires
Malta Malta Digital Innovation Authority Act, Article 6A, Market Surveillance Enforcement Powers of the Authority

Through its governance duty. What it requires
Moldova Council of Europe Framework Convention on Artificial Intelligence, signed by Moldova proposed

Through its DPIA duty. What it requires
Poland Ustawa o systemach sztucznej inteligencji, Act on Artificial Intelligence Systems

Through its governance duty. What it requires
Russia Federal Law No. 243-FZ, Article 8, Duties of Sovereign and National Foundation Model Developers from , in 4 months

Through its governance duty. What it requires
Slovenia Zakon o izvajanju uredbe (EU) o določitvi harmoniziranih pravil o umetni inteligenci (ZIUDHPUI), Designation of AI Act Market Surveillance Authorities

Through its governance duty. What it requires
United Kingdom Council of Europe Framework Convention on Artificial Intelligence, signed by the United Kingdom proposed

Through its DPIA duty. What it requires
United States Artificial Intelligence Risk Management and Security Act of 2026 proposed

Through its governance duty. What it requires
Vanuatu Digital Transformation Act 2025, ICT service permit for AI and AI-related data services

Through its governance duty. What it requires
Vatican City Guidelines on Artificial Intelligence of Vatican City State (Decree No. DCCII)

Through its governance duty. What it requires

AI risk obligations

27 laws, 12 jurisdictions
JurisdictionLawHow it reaches this control
California Clinical Decision Support Systems Bias Mitigation Act (SB 503) from , in 7 weeks

Through its governance duty. What it requires
Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care from , in 7 weeks

Through its governance duty. What it requires
El Salvador Resolución ANIA 0001/2025, registro obligatorio para decisiones consecuenciales

Through its governance duty. What it requires
European Union AI Act, Article 10 (data and data governance) from , in 13 months

Through its governance duty. What it requires
European Union AI Act, Article 111(2) (2030 compliance deadline for public-authority-intended systems) from , in 3.7 years

Through its governance duty. What it requires
European Union AI Act, Article 14 (human oversight) from , in 13 months

Through its governance duty. What it requires
European Union AI Act, Article 16 (obligations of providers of high-risk AI systems) from , in 13 months

Through its governance duty. What it requires
European Union AI Act, Article 17 (quality management system) from , in 13 months

Through its governance duty. What it requires
European Union AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring) from , in 13 months

Through its governance duty. What it requires
European Union AI Act, Article 26(10) (post-remote biometric identification authorisation) from , in 13 months

Through its governance duty. What it requires
Show the other 17 laws
European Union AI Act, Article 27 (fundamental rights impact assessment) from , in 13 months

Through its DPIA duty. What it requires
European Union AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties) from , in 13 months

Through its governance duty. What it requires
European Union AI Act, Article 6(3) and (4) (narrow-task derogation from Annex III high-risk classification) from , in 13 months

Through its governance duty. What it requires
European Union AI Act, Article 72 (post-market monitoring by providers and post-market monitoring plan) from , in 13 months

Through its governance duty. What it requires
European Union AI Act, Article 9 (risk management system) from , in 13 months

Through its governance duty. What it requires
European Union AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent)

Through its governance duty. What it requires
Indiana Downcoding of Health Benefits Claims, automated and AI decision-making (House Enrolled Act 1271, 2026)

Through its governance duty. What it requires
Italy Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them

Through its governance duty. What it requires
Italy Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10)

Through its DPIA, governance duties. What it requires
Italy Decreto Legislativo 160/2026, Police Use of AI Systems: Human Review, Oversight, Collaborations, Sandbox Basis and Training (Artt. 3-6, 21)

Through its governance duty. What it requires
Kyrgyzstan Digital Code, Chapter 23: AI system design and risk-management obligations

Through its DPIA, governance duties. What it requires
Montana Right to Compute Act (SB 212, 2025), critical AI infrastructure risk management duty

Through its governance duty. What it requires
New Jersey AI-based electronic monitoring and automated employment decision systems in employment and public services (S4075 / A4981) proposed

Through its DPIA duty. What it requires
South Korea AI Framework Act, Article 34 (business-operator duties for high-impact AI)

Through its governance duty. What it requires
Vietnam Law on Artificial Intelligence, risk classification and conformity assessment

Through its governance duty. What it requires

AI sector rules

27 laws, 16 jurisdictions
JurisdictionLawHow it reaches this control
Alabama SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization

Through its governance duty. What it requires
California Employment Automated Decision Systems Act (SB 947) from , in 8 months

Through its governance duty. What it requires
California Health Care Services Artificial Intelligence Act (AB 1979) from , in 7 weeks

Through its governance duty. What it requires
Canada CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice

Through its governance duty. What it requires
Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017)

Through its governance duty. What it requires
Canada OSFI Guideline E-23, Model Risk Management (2027) from , in 6 months

Through its governance duty. What it requires
Colorado Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models

Through its governance duty. What it requires
European Union EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance

Through its governance duty. What it requires
European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6)

Through its governance duty. What it requires
European Union MiFID II Suitability Assessment for Investment Advice and Portfolio Management, Including Automated and Semi-Automated Systems (Article 25(2) and Delegated Regulation 2017/565 Article 54)

Through its governance duty. What it requires
Show the other 17 laws
Georgia Private Review Agent Artificial Intelligence Coverage Determinations Act (SB 444) from , in 7 weeks

Through its governance duty. What it requires
Jordan Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0

Through its governance duty. What it requires
Mauritius Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021

Through its governance duty. What it requires
Mauritius FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services

Through its DPIA, governance duties. What it requires
Michigan Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers

Through its governance duty. What it requires
Minnesota Utilization Review, AI-Only Adverse Determination Prohibition from , in 7 weeks

Through its governance duty. What it requires
Nevada AB 406 (2025), licensed provider restriction on direct clinical use of AI

Through its governance duty. What it requires
Saudi Arabia Counter-Fraud Framework: fraud detection systems, machine learning and artificial intelligence

Through its governance duty. What it requires
United Arab Emirates Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E.

Through its governance duty. What it requires
United Arab Emirates Model Management Standards: governance, validation and monitoring of the models a bank uses to decide, including artificial intelligence models

Through its governance duty. What it requires
United Kingdom Artificial Intelligence (AI) update

Through its governance duty. What it requires
United Kingdom Model risk management principles for banks

Through its governance duty. What it requires
United Kingdom Suitability for MiFID business: personal recommendations and decisions to trade, including advice given through an automated or semi-automated system

Through its governance duty. What it requires
United States FINRA Regulatory Notice 24-09, FINRA reminds members of regulatory obligations when using generative artificial intelligence and large language models

Through its governance duty. What it requires
United States Interagency Statement on the Use of Alternative Data in Credit Underwriting

Through its governance duty. What it requires
United States Interagency Supervisory Guidance on Model Risk Management (2026 revision)

Through its governance duty. What it requires
Utah Health Insurance Preauthorization AI Disclosure (SB 319, 2026 General Session) from , in 7 weeks

Through its governance duty. What it requires

AI prohibited practices

2 laws, 2 jurisdictions
JurisdictionLawHow it reaches this control
Denmark Lov nr. 467 af 14. maj 2025, National Competent Authorities and Article 5 Enforcement

Through its governance duty. What it requires
Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13)

Through its DPIA, governance duties. What it requires

AI training data

2 laws, 2 jurisdictions
JurisdictionLawHow it reaches this control
European Union AI Act, Article 53 (obligations for providers of general-purpose AI models)

Through its governance duty. What it requires
Hungary Act XLVII of 1997 on Health Data, Section 35/A(4) to (8), Conditions for AI Development on Electronic Health Service Space Data

Through its DPIA duty. What it requires

AI transparency

1 law, 1 jurisdiction
JurisdictionLawHow it reaches this control
Jamaica Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings

Through its governance duty. What it requires

Full text of the MIT AI Risk Mitigation Taxonomy, CC BY 4.0. MIT AI Risk Initiative (MIT FutureTech), AI Risk Mitigation Taxonomy. Data from the MIT AI Risk Initiative is licensed under CC BY 4.0. Cite as: Mapping AI Risk Mitigations: Evidence Scan & Draft Mitigation Taxonomy Every control of the framework.