Law / Frameworks / MIT mitigations Draft / Technical & Security Controls
MIT mitigations 2.3Model Safety Engineering
Technical methods and safeguards that constrain model behaviors and protect against exploitation and vulnerabilities.MIT AI Risk Mitigation Taxonomy, preliminary taxonomy, July 2025, 2.3
We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of .
The kinds of duty that reach it: design code, security.
- 8
- laws
- 7
- jurisdictions
- 0
- with court rulings behind them
- 4
- not yet in force
- 1
- proposed, not law
Related controls in other frameworks the same duties, in at least two laws we track, reach both
- NIST AI RMFMEASURE 2.6 The AI system is evaluated regularly for safety risks – as identified in the..., 7 laws
- NIST AI RMFMAP 1.6 System requirements (e.g., “the system shall respect the privacy of its..., 4 laws
- NIST AI RMFMEASURE 2.8 Risks associated with transparency and accountability – as identified in the..., 3 laws
- 3 more in the NIST AI RMF
- NIST AI 600-1GAI-RISK-07 Human-AI Configuration, 5 laws
- NIST AI 600-1GAI-RISK-09 Information Security, 5 laws
- NIST AI 600-1GAI-RISK-03 Dangerous, Violent, or Hateful Content, 4 laws
- 3 more in the NIST AI 600-1
- NIST AI 200-22.2 Define & Construct, 4 laws
- NIST AI 200-24.3 Composing a TEVV Toolbox, 4 laws
- OWASP LLM Top 10LLM01:2026 Prompt Injection, 4 laws
- OWASP LLM Top 10LLM02:2026 Sensitive Information Disclosure, 4 laws
- OWASP LLM Top 10LLM04:2026 Supply Chain, 4 laws
- 1 more in the OWASP LLM Top 10
- OWASP Agentic Top 10ASI09 Human-Agent Trust Exploitation, 5 laws
- OWASP Agentic Top 10ASI01 Agent Goal Hijack, 4 laws
- OWASP Agentic Top 10ASI03 Identity and Privilege Abuse, 4 laws
- 1 more in the OWASP Agentic Top 10
- NIST Privacy FrameworkCT.PO-P3 Policies, processes, and procedures for enabling individuals’ data..., 3 laws
- NIST CSF 2.0PR.IR-03 Mechanisms are implemented to achieve resilience requirements in normal and..., 2 laws
- FINOS AIGFAIR-PREV-007 Legal and Contractual Frameworks for AI Systems, 4 laws
- FINOS AIGFAIR-PREV-008 Quality of Service (QoS) and DDoS Prevention for AI Systems, 4 laws
- FINOS AIGFAIR-PREV-012 Role-Based Access Control for AI Data, 4 laws
- 6 more in the FINOS AIGF
- ETSI EN 304 2235.1.2-2 System built to hold up against adversarial attacks, unexpected inputs and failures., 4 laws
- ETSI EN 304 2235.1.3-1 Threat modelling and risk management, reviewed regularly and covering..., 4 laws
- ETSI EN 304 2235.2.1-4 Sensitive data such as training and test sets protected from unauthorised access., 4 laws
- 1 more in the ETSI EN 304 223
A law in force is unmarked; the rest wear their state: not yet in force proposed
AI transparency
5 laws, 5 jurisdictions| Jurisdiction | Law | How it reaches this control |
|---|---|---|
 Colorado |
HB 26-1263 (2026), Conversational AI Service Operator Requirements |
Through its design code duty. What it requires |
 Idaho |
Conversational AI Safety Act from , in 8 months |
Through its design code duty. What it requires |
 Iowa |
Conversational AI Services Act (Senate File 2417) from , in 8 months |
Through its design code duty. What it requires |
| New York City | Chatbot Data Privacy, Security, and Transparency proposed |
Through its security duty. What it requires |
 Oregon |
AI Companion Chatbot Safety Act (SB 1546) from , in 7 weeks |
Through its design code duty. What it requires |
AI risk obligations
2 laws, 2 jurisdictions| Jurisdiction | Law | How it reaches this control |
|---|---|---|
 European Union |
AI Act, Article 15 (accuracy, robustness and cybersecurity) from , in 13 months |
Through its security duty. What it requires |
 Italy |
Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them |
Through its security duty. What it requires |
AI sector rules
1 law, 1 jurisdiction| Jurisdiction | Law | How it reaches this control |
|---|---|---|
| European Union |
MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6) |
Through its security duty. What it requires |
Full text of the MIT AI Risk Mitigation Taxonomy, CC BY 4.0. MIT AI Risk Initiative (MIT FutureTech), AI Risk Mitigation Taxonomy. Data from the MIT AI Risk Initiative is licensed under CC BY 4.0. Cite as: Mapping AI Risk Mitigations: Evidence Scan & Draft Mitigation Taxonomy Every control of the framework.