Law / Frameworks / MIT mitigations Draft / Operational Process Controls

MIT mitigations 3.1Testing & Auditing

Systematic internal and external evaluations that assess AI systems, infrastructure, and compliance processes to identify risks, verify safety, and ensure performance meets standards.MIT AI Risk Mitigation Taxonomy, preliminary taxonomy, July 2025, 3.1

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of 14 Nov 2026.

The kinds of duty that reach it: DPIA, security.

18: laws
13: jurisdictions
0: with court rulings behind them
3: not yet in force
7: proposed, not law

Related controls in other frameworks the same duties, in at least two laws we track, reach both

NIST AI RMFMAP 5.1 Likelihood and magnitude of each identified impact (both potentially..., 10 laws
NIST AI RMFMANAGE 1.3 Responses to the AI risks deemed high priority, as identified by the MAP..., 5 laws
NIST AI RMFMEASURE 2.10 Privacy risk of the AI system – as identified in the MAP function – is..., 4 laws
4 more in the NIST AI RMF
NIST AI 600-1GAI-RISK-04 Data Privacy, 18 laws
NIST AI 600-1GAI-RISK-09 Information Security, 4 laws
NIST AI 600-1GAI-RISK-07 Human-AI Configuration, 2 laws
NIST AI 200-22.4 Synthesize & Interrogate, 14 laws
NIST AI 200-24.3 Composing a TEVV Toolbox, 5 laws
NIST AI 200-22.2 Define & Construct, 4 laws
1 more in the NIST AI 200-2
OWASP LLM Top 10LLM01:2026 Prompt Injection, 4 laws
OWASP LLM Top 10LLM02:2026 Sensitive Information Disclosure, 4 laws
OWASP LLM Top 10LLM04:2026 Supply Chain, 4 laws
2 more in the OWASP LLM Top 10
OWASP Agentic Top 10ASI01 Agent Goal Hijack, 4 laws
OWASP Agentic Top 10ASI03 Identity and Privilege Abuse, 4 laws
OWASP Agentic Top 10ASI04 Agentic Supply Chain Vulnerabilities, 4 laws
1 more in the OWASP Agentic Top 10
NIST CSF 2.0PR.IR-03 Mechanisms are implemented to achieve resilience requirements in normal and..., 2 laws
FINOS AIGFAIR-PREV-005 System Acceptance Testing, 15 laws
FINOS AIGFAIR-PREV-007 Legal and Contractual Frameworks for AI Systems, 4 laws
FINOS AIGFAIR-PREV-008 Quality of Service (QoS) and DDoS Prevention for AI Systems, 4 laws
10 more in the FINOS AIGF
ETSI EN 304 2235.1.3-1 Threat modelling and risk management, reviewed regularly and covering..., 18 laws
ETSI EN 304 2235.1.2-1 Business need and security risks written down and assessed before deciding..., 14 laws
ETSI EN 304 2235.1.2-2 System built to hold up against adversarial attacks, unexpected inputs and failures., 4 laws
6 more in the ETSI EN 304 223

A law in force is unmarked; the rest wear their state: not yet in force proposed

AI governance

7 laws, 7 jurisdictions

Jurisdiction	Law	How it reaches this control
Andorra	Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra proposed	Through its DPIA duty. What it requires
Armenia	Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia proposed	Through its DPIA duty. What it requires
Canada	Council of Europe Framework Convention on Artificial Intelligence, signed by Canada proposed	Through its DPIA duty. What it requires
El Salvador	Ley de Fomento a la Inteligencia Artificial y Tecnologías, marco institucional, registro y evaluación de riesgos	Through its DPIA duty. What it requires
European Union	AI Act, Article 26(9) (using Article 13 information for a data protection impact assessment) from 2 Dec 2027, in 13 months	Through its DPIA duty. What it requires
Moldova	Council of Europe Framework Convention on Artificial Intelligence, signed by Moldova proposed	Through its DPIA duty. What it requires
United Kingdom	Council of Europe Framework Convention on Artificial Intelligence, signed by the United Kingdom proposed	Through its DPIA duty. What it requires

AI risk obligations

6 laws, 4 jurisdictions

Jurisdiction	Law	How it reaches this control
European Union	AI Act, Article 15 (accuracy, robustness and cybersecurity) from 2 Dec 2027, in 13 months	Through its security duty. What it requires
European Union	AI Act, Article 27 (fundamental rights impact assessment) from 2 Dec 2027, in 13 months	Through its DPIA duty. What it requires
Italy	Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them	Through its security duty. What it requires
Italy	Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10)	Through its DPIA duty. What it requires
Kyrgyzstan	Digital Code, Chapter 23: AI system design and risk-management obligations	Through its DPIA duty. What it requires
New Jersey	AI-based electronic monitoring and automated employment decision systems in employment and public services (S4075 / A4981) proposed	Through its DPIA duty. What it requires

AI sector rules

2 laws, 2 jurisdictions

Jurisdiction	Law	How it reaches this control
European Union	MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6)	Through its security duty. What it requires
Mauritius	FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services	Through its DPIA duty. What it requires

AI prohibited practices

1 law, 1 jurisdiction

Jurisdiction	Law	How it reaches this control
Italy	Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13)	Through its DPIA duty. What it requires

AI training data

1 law, 1 jurisdiction

Jurisdiction	Law	How it reaches this control
Hungary	Act XLVII of 1997 on Health Data, Section 35/A(4) to (8), Conditions for AI Development on Electronic Health Service Space Data	Through its DPIA duty. What it requires

AI transparency

1 law, 1 jurisdiction

Jurisdiction	Law	How it reaches this control
New York City	Chatbot Data Privacy, Security, and Transparency proposed	Through its security duty. What it requires

Full text of the MIT AI Risk Mitigation Taxonomy, CC BY 4.0. MIT AI Risk Initiative (MIT FutureTech), AI Risk Mitigation Taxonomy. Data from the MIT AI Risk Initiative is licensed under CC BY 4.0. Cite as: Mapping AI Risk Mitigations: Evidence Scan & Draft Mitigation Taxonomy Every control of the framework.