Law / Frameworks / MIT mitigations / Technical & Security Controls

MIT mitigations 2.1Model & Infrastructure Security

Technical and physical safeguards that secure AI models, weights, and infrastructure to prevent unauthorized access, theft, tampering, and espionage.MIT AI Risk Mitigation Taxonomy, preliminary taxonomy, July 2025, 2.1

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Corpus as of 29 Sep 2026.

The kinds of duty that reach it: access restriction, security.

130: laws
103: places
0: with court rulings behind them
4: not yet in force

The same ground elsewhere linked through the kinds of duty both controls are mapped from

NIST AI RMFMAP 4.1 Approaches for mapping AI technology and legal risks of its components – including the...
NIST AI RMFMEASURE 2.5 The AI system to be deployed is demonstrated to be valid and reliable. Limitations of...
NIST AI 600-1GAI-RISK-09 Information Security
NIST AI 600-1GAI-RISK-04 Data Privacy
OWASP LLM Top 10LLM01:2026 Prompt Injection
OWASP LLM Top 10LLM02:2026 Sensitive Information Disclosure
OWASP Agentic Top 10ASI03 Identity and Privilege Abuse
OWASP Agentic Top 10ASI01 Agent Goal Hijack
NIST Privacy FrameworkPR.AC-P1 Identities and credentials are issued, managed, verified, revoked, and audited for...
NIST Privacy FrameworkPR.AC-P4 Access permissions and authorizations are managed, incorporating the principles of...
NIST CSF 2.0ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded
NIST CSF 2.0ID.RA-08 Processes for receiving, analyzing, and responding to vulnerability disclosures are established

A law in force is unmarked; the rest wear their state: not yet in force

Computer misuse

112 laws, 99 places

Place	Law	How it reaches this control
Afghanistan	Penal Code, Part Twelve, Chapter One (Cyber Crimes and Punishment)	Through its access restriction duty. What it requires
Alabama	Alabama Digital Crime Act, Computer Tampering	Through its access restriction duty. What it requires
Alaska	Criminal mischief in the fourth degree, unauthorized computer access	Through its access restriction duty. What it requires
Alaska	Criminal use of a computer	Through its access restriction duty. What it requires
Alaska	Theft of services, unauthorized use of a computer system	Through its access restriction duty. What it requires
Algeria	Code pénal, atteintes aux systèmes de traitement automatisé de données	Through its access restriction duty. What it requires
Andorra	Penal Code, Attacks on Information Systems	Through its access restriction duty. What it requires
Arkansas	Computer fraud	Through its access restriction duty. What it requires
Arkansas	Computer trespass	Through its access restriction duty. What it requires
Arkansas	Unlawful interference with access to computers; unlawful use or access of computers	Through its access restriction duty. What it requires

Show the other 102 laws

Austria	StGB Sections 118a and 126a to 126c, Computer-Misuse Offenses	Through its access restriction duty. What it requires
Bahamas	Computer Misuse Act 2003, unauthorised access, modification and interception offences	Through its access restriction duty. What it requires
Bangladesh	Cyber Security Act, 2026, unauthorised access to a computer system	Through its access restriction duty. What it requires
Belarus	Criminal Code, Crimes Against Computer Security	Through its access restriction duty. What it requires
Belgium	Code pénal, Livre II, articles 524 à 527, accès non autorisé dans un système informatique	Through its access restriction duty. What it requires
Belize	Cybercrime Act, illegal access to a computer system	Through its access restriction duty. What it requires
Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybercriminalité), atteintes aux réseaux et systèmes d'information	Through its access restriction duty. What it requires
Bermuda	Computer Misuse Act 1996, unauthorised access and modification offences	Through its access restriction duty. What it requires
Bhutan	Information, Communications and Media Act of Bhutan 2018, unauthorized access and tampering with computer systems	Through its access restriction duty. What it requires
Bolivia	Código Penal, Alteración, Acceso y Uso Indebido de Datos Informáticos	Through its access restriction duty. What it requires
Brazil	Penal Code Art. 154-A, Invasion of a Computing Device	Through its access restriction duty. What it requires
Bulgaria	Criminal Code (Nakazatelen kodeks), Art. 319a, Unauthorized Access to an Information System	Through its access restriction duty. What it requires
Burkina Faso	Loi n°025-2018/AN du 31 mai 2018 portant Code pénal, computer and data systems offenses (Livre VII, Titre I, Chapitre 1)	Through its access restriction duty. What it requires
Cabo Verde	Cybercrime Law, Unauthorised Access to a Computer System	Through its access restriction duty. What it requires
Cameroon	Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 68-69 (accès frauduleux)	Through its access restriction duty. What it requires
Colombia	Código Penal, Acceso Abusivo a un Sistema Informático	Through its access restriction duty. What it requires
Comoros	Penal Code, unauthorized access to an information system	Through its access restriction duty. What it requires
Costa Rica	Código Penal, artículo 231, Espionaje informático	Through its access restriction duty. What it requires
Croatia	Kazneni zakon, Computer Crime Chapter (Arts. 266-273)	Through its access restriction duty. What it requires
Cuba	Código Penal (Ley 151/2022), offenses against telecommunications and ICT security	Through its access restriction duty. What it requires
Czech Republic	Criminal Code Section 230, Unauthorized Access to a Computer System	Through its access restriction duty. What it requires
Côte d'Ivoire	Cybercrime Act, unauthorized access to an information system	Through its access restriction duty. What it requires
Egypt	Law No. 175 of 2018 on Anti-Cyber and Information Technology Crimes	Through its access restriction duty. What it requires
El Salvador	Ley de Propiedad Intelectual, elusión de medidas tecnológicas efectivas	Through its access restriction duty. What it requires
El Salvador	Ley Especial contra los Delitos Informáticos y Conexos, acceso indebido a sistemas informáticos	Through its access restriction duty. What it requires
Eritrea	Penal Code of the State of Eritrea, Unauthorized Use of a Computer from a date not yet set	Through its access restriction duty. What it requires
Ethiopia	Computer Crime Proclamation	Through its access restriction duty. What it requires
Finland	Rikoslaki Chapter 38, Tietomurto and törkeä tietomurto (Computer Break-in and Aggravated Computer Break-in)	Through its access restriction duty. What it requires
Gabon	Loi n°027/2023, infractions et sanctions informatiques	Through its access restriction duty. What it requires
Gambia	Information and Communications Act, 2009, Computer Misuse and Cyber Crime part	Through its access restriction duty. What it requires
Georgia	Criminal Code, unauthorised access and interference with computer data and systems	Through its access restriction duty. What it requires
Georgia	Georgia Computer Systems Protection Act, computer theft, trespass, invasion of privacy, forgery, password disclosure from a date not yet set	Through its access restriction duty. What it requires
Ghana	Cybersecurity Act, Unlawful Access	Through its access restriction duty. What it requires
Ghana	Electronic Transactions Act, Cyber Offences	Through its access restriction duty. What it requires
Greece	Penal Code Article 370C (370Γ), Violation of Computer Data and Program Secrets	Through its access restriction duty. What it requires
Greece	Penal Code Article 370D (370Δ), Access to an Information System in Breach of a Prohibition or Security Measure	Through its access restriction duty. What it requires
Guatemala	Código Penal, Decreto 17-73, Arts. 274 'A' a 274 'G' (Delitos Informáticos)	Through its access restriction duty. What it requires
Guinea	Loi n° L/2016/037/AN portant Cybersécurité et Protection des Données à Caractère Personnel, titre relatif aux infractions informatiques (cybercriminalité)	Through its access restriction duty. What it requires
Honduras	Código Penal, seguridad de las redes y de los sistemas informáticos	Through its access restriction duty. What it requires
Hungary	Büntető Törvénykönyv (Criminal Code), Sections 423-424, Violation of Information Systems or Data	Through its access restriction duty. What it requires
Idaho	Computer crime (unauthorized access, use, or alteration)	Through its access restriction duty. What it requires
Jamaica	Cybercrimes Act, 2015, unauthorised access to computer program or data	Through its access restriction duty. What it requires
Jordan	Cybercrime Law, Unauthorized Access to Information Systems	Through its access restriction duty. What it requires
Kentucky	Kentucky Unlawful Access to a Computer	Through its access restriction duty. What it requires
Kiribati	Cybercrime Act 2021, unauthorised access from a date not yet set	Through its access restriction duty. What it requires
Kyrgyzstan	Criminal Code, unauthorized access to computer information	Through its access restriction duty. What it requires
Latvia	Krimināllikums Sections 241, 243, 244, Automated Data Processing System Offences	Through its access restriction duty. What it requires
Libya	Law No. 5 of 2022 on Combating Cybercrimes, unauthorised access and system interference	Through its access restriction duty. What it requires
Lithuania	Criminal Code Arts. 196-198 and 198-1, Computer Misuse and Unauthorised Access Offenses	Through its access restriction duty. What it requires
Louisiana	Louisiana Computer Tampering, unauthorized access and exceeding authorization	Through its access restriction duty. What it requires
Maine	Aggravated criminal invasion of computer privacy	Through its access restriction duty. What it requires
Maine	Criminal invasion of computer privacy	Through its access restriction duty. What it requires
Mali	Loi n° 2019-056, accès et maintien frauduleux à un système d'information	Through its access restriction duty. What it requires
Mauritania	Loi n° 2016-007, accès non autorisé à un système informatique	Through its access restriction duty. What it requires
Mexico	Código Penal Federal, Unauthorised Access to Computer Systems and Equipment (Arts. 211 bis 1 to 211 bis 7)	Through its access restriction duty. What it requires
Mexico	Ley Federal del Derecho de Autor, Technological Protection Measures and Circumvention (Arts. 114 Bis, 232 Bis)	Through its access restriction duty. What it requires
Michigan	Fraudulent Access to Computers, Computer Systems, and Computer Networks Act	Through its access restriction duty. What it requires
Mississippi	Mississippi Computer Crimes and Identity Theft Act, core offenses	Through its access restriction duty. What it requires
Monaco	Code Pénal Arts. 389-1 to 389-9, Unauthorized Access, System Interference and Data Damage	Through its access restriction duty. What it requires
Montenegro	Criminal Code of Montenegro, Unauthorised Access to a Computer System	Through its access restriction duty. What it requires
Nauru	Cybercrime Act 2015, illegal access to a protected computer	Through its access restriction duty. What it requires
Nepal	Electronic Transactions Act, 2063, unauthorised access to computer materials	Through its access restriction duty. What it requires
Nevada	Unlawful acts regarding computers, private action and enforcement	Through its access restriction duty. What it requires
Nicaragua	Ley No. 1042, interference with and damage to computer systems, as reformed by Ley No. 1219	Through its access restriction duty. What it requires
Nicaragua	Ley No. 1042, unauthorized access to computer systems	Through its access restriction duty. What it requires
North Carolina	North Carolina Computer-Related Crime Act (unauthorized access and computer trespass)	Through its access restriction duty. What it requires
North Dakota	Computer fraud and computer crime	Through its access restriction duty. What it requires
Panama	Código Penal, Delitos contra la Seguridad Informática	Through its access restriction duty. What it requires
Paraguay	Código Penal, arts. 146 b y 174 b, introducidos por la Ley N° 4439/2011, acceso indebido a datos y a sistemas informáticos	Through its access restriction duty. What it requires
Pennsylvania	Unlawful use of computer and other computer crimes (hacking and similar offenses)	Through its access restriction duty. What it requires
Peru	Decreto Legislativo 1700, illicit trafficking of computer data (art. 12-A of Ley 30096)	Through its access restriction duty. What it requires
Peru	Ley 30096, unauthorized access and data/system integrity offenses	Through its access restriction duty. What it requires
Poland	Kodeks karny, Unauthorized Access to Information and Computer-Misuse Offenses	Through its access restriction duty. What it requires
Qatar	Cybercrime Prevention Law, unauthorised access	Through its access restriction duty. What it requires
Romania	Cod penal, Art. 360-366, Infracțiuni contra siguranței și integrității sistemelor și datelor informatice (Offences Against the Security and Integrity of Computer Systems and Data)	Through its access restriction duty. What it requires
Russia	Criminal Code Article 272, Unauthorized Access to Computer Information	Through its access restriction duty. What it requires
Russia	Criminal Code Article 274, Violation of Rules for Operating Computer-Information Storage, Processing or Transmission Systems	Through its access restriction duty. What it requires
Samoa	Crimes Act 2013, computer-access and interference offences	Through its access restriction duty. What it requires
San Marino	Computer Crimes Law, Unlawful Access to Computer or Telematics Systems	Through its access restriction duty. What it requires
Senegal	Loi n° 2008-11 du 25 janvier 2008 sur la Cybercriminalité, unauthorized computer-system access (Penal Code arts. 431-8 to 431-9)	Through its access restriction duty. What it requires
Serbia	Criminal Code, Offences Against the Security of Computer Data	Through its access restriction duty. What it requires
Slovenia	Kazenski zakonik (KZ-1, Criminal Code), Art. 221, Napad na informacijski sistem (Attack on an Information System)	Through its access restriction duty. What it requires
South Carolina	South Carolina Computer Crime Act	Through its access restriction duty. What it requires
South Sudan	National Communication Act, 2012, confidentiality and unauthorised interception of communications	Through its access restriction duty. What it requires
South Sudan	Penal Code Act, 2008, computer and electronic related offences	Through its access restriction duty. What it requires
State of Palestine	Law by Decree No. 10 of 2018 on Cybercrime, Unauthorised Access and Computer Interference	Through its access restriction duty. What it requires
Suriname	Wetboek van Strafrecht, Hacking and Denial of Access (arts. 187b-187c)	Through its access restriction duty. What it requires
Sweden	Brottsbalken 4 kap. 9 c §, Unauthorized Computer Access (Dataintrång)	Through its access restriction duty. What it requires
Switzerland	Swiss Criminal Code, Unauthorised Access to and Interference with Data Processing Systems	Through its access restriction duty. What it requires
Taiwan	Criminal Code, Offenses Against Computer Security	Through its access restriction duty. What it requires
Togo	Loi n° 2018-026, accès et maintien frauduleux à un système informatique	Through its access restriction duty. What it requires
Tonga	Computer Crimes Act 2003, unauthorised access	Through its access restriction duty. What it requires
Trinidad and Tobago	Computer Misuse Act 2000, Unauthorised Access	Through its access restriction duty. What it requires
Turkey	Turkish Penal Code, Information System Crimes	Through its access restriction duty. What it requires
Tuvalu	Tuvalu Telecommunications Corporation Act 1993, offences and penalties	Through its access restriction duty. What it requires
Uruguay	Código Penal arts. 297 bis, 297 ter, 297 quater, 358 quater, and 358 quinquies, computer-offence provisions inserted by Ley N° 20.327	Through its access restriction duty. What it requires
Vanuatu	Cybercrime Act 2021, computer-access and interference offences	Through its access restriction duty. What it requires
Vatican City	Unauthorised access to a protected computer or telematic system (Legge N. DXXXI, arts. 158 ter-158 quater)	Through its access restriction duty. What it requires
Venezuela	Ley Especial contra los Delitos Informáticos, unauthorized access and sabotage of systems (Arts. 6-11)	Through its access restriction duty. What it requires
Wyoming	Crimes against computer users (bare without-authorization test)	Through its access restriction duty. What it requires
Zambia	Cyber Crimes Act, 2025, unauthorised access to computer system and data	Through its access restriction duty. What it requires
Zimbabwe	Cyber and Data Protection Act, Insertion of Computer-Misuse Offences into the Criminal Law Code	Through its access restriction duty. What it requires

Database right

14 laws, 14 places

Place	Law	How it reaches this control
Albania	Copyright Law, Sui Generis Database Producers Rights	Through its access restriction duty. What it requires
Algeria	Ordonnance n° 03-05, protection des bases de données	Through its access restriction duty. What it requires
Czech Republic	Autorský zákon Sections 88-94, Sui Generis Database Right	Through its access restriction duty. What it requires
Ethiopia	Copyright and Neighbouring Rights Protection Proclamation, Database Protection	Through its access restriction duty. What it requires
Gabon	Loi n°1/87, protection des recueils et compilations	Through its access restriction duty. What it requires
Georgia	Copyright and Related Rights, database producer right	Through its access restriction duty. What it requires
Ghana	Copyright Act, Database Protection	Through its access restriction duty. What it requires
Guatemala	Ley de Derecho de Autor y Derechos Conexos, Decreto 33-98 (compilations, databases, and technological measures)	Through its access restriction duty. What it requires
Latvia	Autortiesību likums Chapter IX, Sui Generis Database Right	Through its access restriction duty. What it requires
Montenegro	Law on Copyright and Related Rights, Rights of Makers of Databases	Through its access restriction duty. What it requires

Show the other 4 laws

Nepal	Copyright Act, 2059, database compilation protection and digital reproduction limit	Through its access restriction duty. What it requires
Poland	Ustawa o ochronie baz danych, Sui Generis Database Right	Through its access restriction duty. What it requires
Samoa	Copyright Act 1998, compilation-only protection of collections and databases	Through its access restriction duty. What it requires
Sao Tome and Principe	Decreto-Lei n.º 02/2017, protecção de compilações e exclusão das notícias do dia	Through its access restriction duty. What it requires

Copyright and text and data mining (TDM)

2 laws, 2 places

Place	Law	How it reaches this control
Cook Islands	Copyright Act 2013, economic rights, computer program copying, and technological protection measures	Through its access restriction duty. What it requires
Libya	Law No. 9 of 1968, protected works and collections	Through its access restriction duty. What it requires

AI risk obligations

1 law, 1 place

Place	Law	How it reaches this control
European Union	AI Act, Article 15 (accuracy, robustness and cybersecurity) from 2 Dec 2027, in 14 months	Through its security duty. What it requires

Personal data

1 law, 1 place

Place	Law	How it reaches this control
Colombia	Código Penal, Violación de Datos Personales	Through its access restriction duty. What it requires

Full text of the MIT AI Risk Mitigation Taxonomy, CC BY 4.0. MIT AI Risk Initiative (MIT FutureTech), AI Risk Mitigation Taxonomy, https://airisk.mit.edu/ai-risk-mitigations. Data from the MIT AI Risk Initiative is licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Cite as: Mapping AI Risk Mitigations: Evidence Scan & Draft Mitigation Taxonomy, https://airisk.mit.edu/blog/mapping-ai-risk-mitigations Every control of the framework.