LexLint

Know the law your code answers to.

Law / Frameworks / MIT mitigations / Governance & Oversight Controls

MIT mitigations 1.2Risk Management

Systematic methods that identify, evaluate, and manage AI risks for comprehensive risk governance across organizations.MIT AI Risk Mitigation Taxonomy, preliminary taxonomy, July 2025, 1.2

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Corpus as of .

The kinds of duty that reach it: DPIA, governance.

41
laws
27
places
0
with court rulings behind them
20
not yet in force
3
proposed, not law

The same ground elsewhere linked through the kinds of duty both controls are mapped from

A law in force is unmarked; the rest wear their state: not yet in force proposed

  • Alabama
  • Andorra
  • Armenia
  • California
  • Colorado
  • Denmark
  • El Salvador
  • European Union
  • Georgia
  • Germany
  • Hungary
  • Illinois
  • Indiana
  • Jamaica
  • Kyrgyzstan
  • Maine
  • Malta
  • Minnesota
  • Moldova
  • Montana
  • Nevada
  • Russia
  • South Korea
  • Utah
  • Vanuatu
  • Vatican City
  • Vietnam

AI governance

16 laws, 12 places
PlaceLawHow it reaches this control
Andorra Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra proposed

Through its DPIA duty. What it requires
Armenia Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia proposed

Through its DPIA duty. What it requires
California Transparency in Frontier Artificial Intelligence Act (SB 53)

Through its governance duty. What it requires
El Salvador Ley de Fomento a la Inteligencia Artificial y Tecnologías, marco institucional, registro y evaluación de riesgos

Through its DPIA duty. What it requires
European Union AI Act, Article 12 (record-keeping) from , in 14 months

Through its governance duty. What it requires
European Union AI Act, Article 19 (automatically generated logs) from , in 14 months

Through its governance duty. What it requires
European Union AI Act, Article 21(2) (competent authority access to automatically generated logs) from , in 14 months

Through its governance duty. What it requires
European Union AI Act, Article 26(6) (deployer log-keeping) from , in 14 months

Through its governance duty. What it requires
European Union AI Act, Article 26(9) (using Article 13 information for a data protection impact assessment) from , in 14 months

Through its DPIA duty. What it requires
Germany Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act

Through its governance duty. What it requires
Show the other 6 laws
Hungary Act LXXV of 2025 on the Domestic Implementation of the EU AI Regulation

Through its governance duty. What it requires
Illinois Artificial Intelligence Safety Measures Act from , in 3 months

Through its governance duty. What it requires
Moldova Council of Europe Framework Convention on Artificial Intelligence, signed by Moldova proposed

Through its DPIA duty. What it requires
Russia Federal Law No. 243-FZ, Article 8, Duties of Sovereign and National Foundation Model Developers from , in 5 months

Through its governance duty. What it requires
Vanuatu Digital Transformation Act 2025, ICT service permit for AI and AI-related data services

Through its governance duty. What it requires
Vatican City Guidelines on Artificial Intelligence of Vatican City State (Decree No. DCCII)

Through its governance duty. What it requires

AI risk obligations

15 laws, 8 places
PlaceLawHow it reaches this control
El Salvador Resolución ANIA 0001/2025, registro obligatorio para decisiones consecuenciales

Through its governance duty. What it requires
European Union AI Act, Article 10 (data and data governance) from , in 14 months

Through its governance duty. What it requires
European Union AI Act, Article 111(2) (2030 compliance deadline for public-authority-intended systems) from , in 3.8 years

Through its governance duty. What it requires
European Union AI Act, Article 14 (human oversight) from , in 14 months

Through its governance duty. What it requires
European Union AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring) from , in 14 months

Through its governance duty. What it requires
European Union AI Act, Article 26(10) (post-remote biometric identification authorisation) from , in 14 months

Through its governance duty. What it requires
European Union AI Act, Article 27 (fundamental rights impact assessment) from , in 14 months

Through its DPIA duty. What it requires
European Union AI Act, Article 6(3) and (4) (narrow-task derogation from Annex III high-risk classification) from , in 14 months

Through its governance duty. What it requires
European Union AI Act, Article 9 (risk management system) from , in 14 months

Through its governance duty. What it requires
Indiana Downcoding of Health Benefits Claims, automated and AI decision-making (House Enrolled Act 1271, 2026)

Through its governance duty. What it requires
Show the other 5 laws
Kyrgyzstan Digital Code, Chapter 23: AI system design and risk-management obligations

Through its DPIA, governance duties. What it requires
Montana Right to Compute Act (SB 212, 2025), critical AI infrastructure risk management duty

Through its governance duty. What it requires
South Korea AI Framework Act, Article 34 (business-operator duties for high-impact AI)

Through its governance duty. What it requires
Vietnam Law on Artificial Intelligence, risk classification and conformity assessment

Through its governance duty. What it requires

AI sector rules

7 laws, 7 places
PlaceLawHow it reaches this control
Alabama SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization from , in 2 days

Through its governance duty. What it requires
Colorado Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models

Through its governance duty. What it requires
Georgia Private Review Agent Artificial Intelligence Coverage Determinations Act (SB 444) from , in 3 months

Through its governance duty. What it requires
Maine Use of artificial intelligence in therapy or psychotherapy services from a date not yet set

Through its governance duty. What it requires
Minnesota Utilization Review, AI-Only Adverse Determination Prohibition from , in 3 months

Through its governance duty. What it requires
Nevada AB 406 (2025), licensed provider restriction on direct clinical use of AI

Through its governance duty. What it requires
Utah Health Insurance Preauthorization AI Disclosure (SB 319, 2026 General Session) from , in 3 months

Through its governance duty. What it requires

AI prohibited practices

1 law, 1 place
PlaceLawHow it reaches this control
Denmark Lov nr. 467 af 14. maj 2025, National Competent Authorities and Article 5 Enforcement

Through its governance duty. What it requires

AI training data

1 law, 1 place
PlaceLawHow it reaches this control
European Union AI Act, Article 53 (obligations for providers of general-purpose AI models)

Through its governance duty. What it requires

AI transparency

1 law, 1 place
PlaceLawHow it reaches this control
Jamaica Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings

Through its governance duty. What it requires

Full text of the MIT AI Risk Mitigation Taxonomy, CC BY 4.0. MIT AI Risk Initiative (MIT FutureTech), AI Risk Mitigation Taxonomy, https://airisk.mit.edu/ai-risk-mitigations. Data from the MIT AI Risk Initiative is licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Cite as: Mapping AI Risk Mitigations: Evidence Scan & Draft Mitigation Taxonomy, https://airisk.mit.edu/blog/mapping-ai-risk-mitigations Every control of the framework.