Law / Frameworks / MIT mitigations Draft / Operational Process Controls

MIT mitigations 3.2Data Governance

Policies and procedures that govern responsible data acquisition, curation, and usage to ensure compliance, quality, user privacy, and removal of harmful content.MIT AI Risk Mitigation Taxonomy, preliminary taxonomy, July 2025, 3.2

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of 14 Nov 2026.

The kinds of duty that reach it: TDM, access restriction, attribution, biometric, consent, data subject rights, retention, transfer.

214: laws
131: jurisdictions
5: with court rulings behind them
9: not yet in force
2: proposed, not law

Related controls in other frameworks the same duties, in at least two laws we track, reach both

NIST AI RMFMAP 4.1 Approaches for mapping AI technology and legal risks of its components –..., 198 laws
NIST AI RMFMAP 1.6 System requirements (e.g., “the system shall respect the privacy of its..., 5 laws
NIST AI RMFMEASURE 2.9 The AI model is explained, validated, and documented, and AI system output..., 4 laws
6 more in the NIST AI RMF
NIST AI 600-1GAI-RISK-12 Value Chain and Component Integration, 165 laws
NIST AI 600-1GAI-RISK-09 Information Security, 148 laws
NIST AI 600-1GAI-RISK-10 Intellectual Property, 57 laws
4 more in the NIST AI 600-1
NIST AI 200-22.3 Apply & Measure, 5 laws
NIST AI 200-24.3 Composing a TEVV Toolbox, 5 laws
OWASP LLM Top 10LLM03:2026 Excessive Agency, 153 laws
OWASP Agentic Top 10ASI03 Identity and Privilege Abuse, 148 laws
OWASP Agentic Top 10ASI09 Human-Agent Trust Exploitation, 5 laws
NIST Privacy FrameworkCT.PO-P1 Policies, processes, and procedures for authorizing data processing (e.g.,..., 31 laws
NIST Privacy FrameworkCM.AW-P1 Mechanisms (e.g., notices, internal or public reports) for communicating..., 5 laws
NIST Privacy FrameworkCT.DM-P10 Stakeholder privacy preferences are included in algorithmic design..., 3 laws
FINOS AIGFAIR-PREV-018 Agent Authority Least Privilege Framework, 148 laws
FINOS AIGFAIR-PREV-023 Agentic System Credential Protection Framework, 148 laws
FINOS AIGFAIR-PREV-007 Legal and Contractual Frameworks for AI Systems, 57 laws
7 more in the FINOS AIGF
ETSI EN 304 2235.1.2-6 Access the AI system gets to other systems and data sources is minimal and..., 148 laws
ETSI EN 304 2235.2.4-2.1 Minimum record for training data: its source, such as a page URL, and when..., 20 laws
ETSI EN 304 2235.1.4-3 Where oversight is a risk control, the technical measures behind it are..., 5 laws
7 more in the ETSI EN 304 223

A law in force is unmarked; the rest wear their state: not yet in force proposed

Computer misuse

121 laws, 105 jurisdictions

Jurisdiction	Law	How it reaches this control
Afghanistan	Penal Code, Part Twelve, Chapter One (Cyber Crimes and Punishment)	Through its access restriction duty. What it requires
Alabama	Alabama Digital Crime Act, Computer Tampering	Through its access restriction duty. What it requires
Alaska	Criminal mischief in the fourth degree, unauthorized computer access	Through its access restriction duty. What it requires
Alaska	Criminal use of a computer	Through its access restriction duty. What it requires
Alaska	Theft of services, unauthorized use of a computer system	Through its access restriction duty. What it requires
Albania	Criminal Code, Unauthorized Computer Access	Through its access restriction duty. What it requires
Algeria	Code pénal, atteintes aux systèmes de traitement automatisé de données	Through its access restriction duty. What it requires
Andorra	Penal Code, Attacks on Information Systems	Through its access restriction duty. What it requires
Arkansas	Computer fraud	Through its access restriction duty. What it requires
Arkansas	Computer trespass	Through its access restriction duty. What it requires

Show the other 111 laws

Arkansas	Unlawful interference with access to computers; unlawful use or access of computers	Through its access restriction duty. What it requires
Austria	StGB Sections 118a and 126a to 126c, Computer-Misuse Offenses	Through its access restriction duty. What it requires
Bahamas	Computer Misuse Act 2003, unauthorised access, modification and interception offences	Through its access restriction duty. What it requires
Bangladesh	Cyber Security Act, 2026, unauthorised access to a computer system	Through its access restriction duty. What it requires
Belarus	Criminal Code, Crimes Against Computer Security	Through its access restriction duty. What it requires
Belgium	Code pénal, Livre II, articles 524 à 533, accès non autorisé et sabotage dans un système informatique	Through its access restriction duty. What it requires
Belize	Cybercrime Act, illegal access to a computer system	Through its access restriction duty. What it requires
Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybercriminalité), atteintes aux réseaux et systèmes d'information	Through its access restriction duty. What it requires
Bermuda	Computer Misuse Act 1996, unauthorised access and modification offences	Through its access restriction duty. What it requires
Bhutan	Information, Communications and Media Act of Bhutan 2018, unauthorized access and tampering with computer systems	Through its access restriction duty. What it requires
Bolivia	Código Penal, Alteración, Acceso y Uso Indebido de Datos Informáticos	Through its access restriction duty. What it requires
Brazil	Penal Code Art. 154-A, Invasion of a Computing Device	Through its access restriction duty. What it requires
Bulgaria	Criminal Code (Nakazatelen kodeks), Art. 319a, Unauthorized Access to an Information System	Through its access restriction duty. What it requires
Bulgaria	Criminal Code (Nakazatelen kodeks), Art. 319b, Interference with Data in an Information System	Through its access restriction duty. What it requires
Burkina Faso	Loi n°025-2018/AN du 31 mai 2018 portant Code pénal, computer and data systems offenses (Livre VII, Titre I, Chapitre 1)	Through its access restriction duty. What it requires
Cabo Verde	Cybercrime Law, Unauthorised Access to a Computer System	Through its access restriction duty. What it requires
Cameroon	Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 68-69 (accès frauduleux)	Through its access restriction duty. What it requires
Colombia	Código Penal, Acceso Abusivo a un Sistema Informático	Through its access restriction duty. What it requires
Comoros	Penal Code, unauthorized access to an information system	Through its access restriction duty. What it requires
Costa Rica	Código Penal, artículo 231, Espionaje informático	Through its access restriction duty. What it requires
Croatia	Kazneni zakon, Computer Crime Chapter (Arts. 266-273)	Through its access restriction duty. What it requires
Cuba	Código Penal (Ley 151/2022), offenses against telecommunications and ICT security	Through its access restriction duty. What it requires
Czech Republic	Criminal Code Section 230, Unauthorized Access to a Computer System	Through its access restriction duty. What it requires
Côte d'Ivoire	Cybercrime Act, unauthorized access to an information system	Through its access restriction duty. What it requires
Egypt	Law No. 175 of 2018 on Anti-Cyber and Information Technology Crimes	Through its access restriction duty. What it requires
El Salvador	Ley de Propiedad Intelectual, elusión de medidas tecnológicas efectivas	Through its access restriction duty. What it requires
El Salvador	Ley Especial contra los Delitos Informáticos y Conexos, acceso indebido a sistemas informáticos	Through its access restriction duty. What it requires
Eritrea	Penal Code of the State of Eritrea, Unauthorized Use of a Computer from a date not yet set	Through its access restriction duty. What it requires
Ethiopia	Computer Crime Proclamation	Through its access restriction duty. What it requires
European Union	Cybercrime Directive, Articles 2(d) and 3 to 12 (offenses against information systems, penalties and jurisdiction)	Through its access restriction duty. What it requires
European Union	Data Act, Article 11 (technical protection measures on access to data)	Through its access restriction duty. What it requires
Finland	Rikoslaki Chapter 38, Tietomurto and törkeä tietomurto (Computer Break-in and Aggravated Computer Break-in)	Through its access restriction duty. What it requires
Gabon	Loi n°027/2023, infractions et sanctions informatiques	Through its access restriction duty. What it requires
Gambia	Information and Communications Act, 2009, Computer Misuse and Cyber Crime part	Through its access restriction duty. What it requires
Georgia	Criminal Code, unauthorised access and interference with computer data and systems	Through its access restriction duty. What it requires
Georgia	Georgia Computer Systems Protection Act, computer theft, trespass, invasion of privacy, forgery, password disclosure	Through its access restriction duty. What it requires
Ghana	Cybersecurity Act, Unlawful Access	Through its access restriction duty. What it requires
Ghana	Electronic Transactions Act, Cyber Offences	Through its access restriction duty. What it requires
Greece	Penal Code Article 370B (370Β), Illegal Access to an Information System or to Data	Through its access restriction duty. What it requires
Greece	Penal Code Article 370C (370Γ), Violation of Computer Data and Program Secrets	Through its access restriction duty. What it requires
Greece	Penal Code Article 370D (370Δ), Access to an Information System in Breach of a Prohibition or Security Measure	Through its access restriction duty. What it requires
Guatemala	Código Penal, Decreto 17-73, Arts. 274 'A' a 274 'G' (Delitos Informáticos)	Through its access restriction duty. What it requires
Guinea	Loi n° L/2016/037/AN portant Cybersécurité et Protection des Données à Caractère Personnel, titre relatif aux infractions informatiques (cybercriminalité)	Through its access restriction duty. What it requires
Honduras	Código Penal, seguridad de las redes y de los sistemas informáticos	Through its access restriction duty. What it requires
Hungary	Büntető Törvénykönyv (Criminal Code), Sections 423-424, Violation of Information Systems or Data	Through its access restriction duty. What it requires
Idaho	Computer crime (unauthorized access, use, or alteration)	Through its access restriction duty. What it requires
India	Information Technology Act, Unauthorized Access and Computer-Related Offences	Through its access restriction duty. What it requires
Jamaica	Cybercrimes Act, 2015, unauthorised access to computer program or data	Through its access restriction duty. What it requires
Jordan	Cybercrime Law, Unauthorized Access to Information Systems	Through its access restriction duty. What it requires
Kentucky	Kentucky Unlawful Access to a Computer	Through its access restriction duty. What it requires
Kiribati	Cybercrime Act 2021, unauthorised access from a date not yet set	Through its access restriction duty. What it requires
Kyrgyzstan	Criminal Code, unauthorized access to computer information	Through its access restriction duty. What it requires
Latvia	Krimināllikums Sections 241, 243, 244, Automated Data Processing System Offences	Through its access restriction duty. What it requires
Libya	Law No. 5 of 2022 on Combating Cybercrimes, unauthorised access and system interference	Through its access restriction duty. What it requires
Lithuania	Criminal Code Arts. 196-198 and 198-1, Computer Misuse and Unauthorised Access Offenses	Through its access restriction duty. What it requires
Louisiana	Louisiana Computer Tampering, unauthorized access and exceeding authorization	Through its access restriction duty. What it requires
Maine	Aggravated criminal invasion of computer privacy	Through its access restriction duty. What it requires
Maine	Criminal invasion of computer privacy	Through its access restriction duty. What it requires
Mali	Loi n° 2019-056, accès et maintien frauduleux à un système d'information	Through its access restriction duty. What it requires
Mauritania	Loi n° 2016-007, accès non autorisé à un système informatique	Through its access restriction duty. What it requires
Mexico	Código Penal Federal, Unauthorised Access to Computer Systems and Equipment (Arts. 211 bis 1 to 211 bis 7)	Through its access restriction duty. What it requires
Mexico	Ley Federal del Derecho de Autor, Technological Protection Measures and Circumvention (Arts. 114 Bis, 232 Bis)	Through its access restriction duty. What it requires
Michigan	Fraudulent Access to Computers, Computer Systems, and Computer Networks Act	Through its access restriction duty. What it requires
Mississippi	Mississippi Computer Crimes and Identity Theft Act, core offenses	Through its access restriction duty. What it requires
Monaco	Code Pénal Arts. 389-1 to 389-9, Unauthorized Access, System Interference and Data Damage	Through its access restriction duty. What it requires
Montenegro	Criminal Code of Montenegro, Unauthorised Access to a Computer System	Through its access restriction duty. What it requires
Nauru	Cybercrime Act 2015, illegal access to a protected computer	Through its access restriction duty. What it requires
Nepal	Electronic Transactions Act, 2063, unauthorised access to computer materials	Through its access restriction duty. What it requires
Nevada	Unlawful acts regarding computers, private action and enforcement	Through its access restriction duty. What it requires
Nicaragua	Ley No. 1042, interference with and damage to computer systems, as reformed by Ley No. 1219	Through its access restriction duty. What it requires
Nicaragua	Ley No. 1042, unauthorized access to computer systems	Through its access restriction duty. What it requires
North Carolina	North Carolina Computer-Related Crime Act (unauthorized access and computer trespass)	Through its access restriction duty. What it requires
North Dakota	Computer fraud and computer crime	Through its access restriction duty. What it requires
North Korea	Intellectual Property Law, Technical Protective Measures and Liability	Through its access restriction duty. What it requires
Panama	Código Penal, Delitos contra la Seguridad Informática	Through its access restriction duty. What it requires
Paraguay	Código Penal, arts. 146 b y 174 b, introducidos por la Ley N° 4439/2011, acceso indebido a datos y a sistemas informáticos	Through its access restriction duty. What it requires
Pennsylvania	Unlawful use of computer and other computer crimes (hacking and similar offenses)	Through its access restriction duty. What it requires
Peru	Decreto Legislativo 1700, illicit trafficking of computer data (art. 12-A of Ley 30096)	Through its access restriction duty. What it requires
Peru	Ley 30096, unauthorized access and data/system integrity offenses	Through its access restriction duty. What it requires
Poland	Kodeks karny, Unauthorized Access to Information and Computer-Misuse Offenses	Through its access restriction duty. What it requires
Qatar	Cybercrime Prevention Law, unauthorised access	Through its access restriction duty. What it requires
Rhode Island	Rhode Island Computer Crime chapter, unauthorized access and computer trespass	Through its access restriction duty. What it requires
Romania	Cod penal, Art. 360-366, Infracțiuni contra siguranței și integrității sistemelor și datelor informatice (Offences Against the Security and Integrity of Computer Systems and Data)	Through its access restriction duty. What it requires
Russia	Criminal Code Article 272, Unauthorized Access to Computer Information	Through its access restriction duty. What it requires
Russia	Criminal Code Article 274, Violation of Rules for Operating Computer-Information Storage, Processing or Transmission Systems	Through its access restriction duty. What it requires
Samoa	Crimes Act 2013, computer-access and interference offences	Through its access restriction duty. What it requires
San Marino	Computer Crimes Law, Unlawful Access to Computer or Telematics Systems	Through its access restriction duty. What it requires
Senegal	Loi n° 2008-11 du 25 janvier 2008 sur la Cybercriminalité, unauthorized computer-system access (Penal Code arts. 431-8 to 431-9)	Through its access restriction duty. What it requires
Serbia	Criminal Code, Offences Against the Security of Computer Data	Through its access restriction duty. What it requires
Slovenia	Kazenski zakonik (KZ-1, Criminal Code), Art. 221, Napad na informacijski sistem (Attack on an Information System)	Through its access restriction duty. What it requires
South Carolina	South Carolina Computer Crime Act	Through its access restriction duty. What it requires
South Sudan	National Communication Act, 2012, confidentiality and unauthorised interception of communications	Through its access restriction duty. What it requires
South Sudan	Penal Code Act, 2008, computer and electronic related offences	Through its access restriction duty. What it requires
State of Palestine	Law by Decree No. 10 of 2018 on Cybercrime, Unauthorised Access and Computer Interference	Through its access restriction duty. What it requires
Suriname	Wetboek van Strafrecht, Hacking and Denial of Access (arts. 187b-187c)	Through its access restriction duty. What it requires
Sweden	Brottsbalken 4 kap. 9 c §, Unauthorized Computer Access (Dataintrång)	Through its access restriction duty. What it requires
Switzerland	Swiss Criminal Code, Unauthorised Access to and Interference with Data Processing Systems	Through its access restriction duty. What it requires
Taiwan	Criminal Code, Offenses Against Computer Security	Through its access restriction duty. What it requires
Togo	Loi n° 2018-026, accès et maintien frauduleux à un système informatique	Through its access restriction duty. What it requires
Tonga	Computer Crimes Act 2025, unauthorised access to or modification of computer data	Through its access restriction duty. What it requires
Trinidad and Tobago	Computer Misuse Act 2000, Unauthorised Access	Through its access restriction duty. What it requires
Turkey	Turkish Penal Code, Information System Crimes	Through its access restriction duty. What it requires
Tuvalu	Tuvalu Telecommunications Corporation Act 1993, offences and penalties	Through its access restriction duty. What it requires
Uruguay	Código Penal arts. 297 bis, 297 ter, 297 quater, 358 quater, and 358 quinquies, computer-offence provisions inserted by Ley N° 20.327	Through its access restriction duty. What it requires
Vanuatu	Cybercrime Act 2021, computer-access and interference offences	Through its access restriction duty. What it requires
Vatican City	Unauthorised access to a protected computer or telematic system (Legge N. DXXXI, arts. 158 ter-158 quater)	Through its access restriction duty. What it requires
Venezuela	Ley Especial contra los Delitos Informáticos, unauthorized access and sabotage of systems (Arts. 6-11)	Through its access restriction duty. What it requires
West Virginia	West Virginia Computer Crime and Abuse Act	Through its access restriction duty. What it requires
Wyoming	Crimes against computer users (bare without-authorization test)	Through its access restriction duty. What it requires
Zambia	Cyber Crimes Act, 2025, unauthorised access to computer system and data	Through its access restriction duty. What it requires
Zimbabwe	Cyber and Data Protection Act, Insertion of Computer-Misuse Offences into the Criminal Law Code	Through its access restriction duty. What it requires

Copyright and text and data mining (TDM)

25 laws, 24 jurisdictions

Jurisdiction	Law	How it reaches this control
Azerbaijan	Copyright and Related Rights Law, database exclusion and enforcement remedies	Through its TDM, access restriction duties. What it requires
Belgium	Code de droit économique, article XI.190, 20°, exception de fouille de textes et de données	Through its TDM duty. What it requires
Bosnia and Herzegovina	Law on Copyright and Related Rights, Content Limitations (No Text-and-Data-Mining Exception)	Through its TDM duty. What it requires
Bulgaria	Copyright and Neighbouring Rights Act (ZAPSP), Arts. 26e, 26zh and 26k, Text-and-Data-Mining Exception for Crawling and Training	Through its TDM duty. What it requires
Cayman Islands	Copyright (Cayman Islands) Order 2015, text and data analysis exception	Through its TDM duty. What it requires
Cook Islands	Copyright Act 2013, economic rights, computer program copying, and technological protection measures	Through its TDM, access restriction duties. What it requires
Czech Republic	Autorský zákon Sections 39c-39d, Text and Data Mining Exception for Automated Analysis	Through its TDM duty. What it requires
European Union	DSM Directive, Article 4 (text-and-data-mining exception and rights reservation)	Through its TDM duty. What it requires
European Union	Information Society Directive, Protection of Technological Measures and Rights-Management Information	Through its access restriction duty. What it requires
Fiji	Copyright Act 1999, Fair Dealing and Criminal Liability for Infringement from a date not yet set	Through its TDM duty. What it requires

Show the other 15 laws

France	CPI Technical Protection Measures, Protection of Effective Technical Measures and the Offences of Circumventing Them	Through its access restriction duty. What it requires
Georgia	Copyright and Related Rights, no text-and-data-mining exception	Through its TDM duty. What it requires
Germany	Schutz technischer Massnahmen und Durchsetzung von Schrankenbestimmungen (Protection of Technological Measures)	Through its TDM, access restriction duties. What it requires
Honduras	Ley del Derecho de Autor, sin excepción de minería de textos y datos, protección de compilaciones	Through its TDM duty. What it requires
Italy	Legge sul Diritto d'Autore Artt. 70-ter and 70-quater, Text-and-Data-Mining Exceptions	Through its TDM duty. What it requires
Latvia	Autortiesību likums Article 21.1, Text and Data Mining Exception (Scraping and AI Training)	Through its TDM duty. What it requires
Libya	Law No. 9 of 1968, protected works and collections	Through its access restriction duty. What it requires
Maldives	Copyright and Related Rights Act, quotation and informational-purpose exceptions	Through its attribution duty. What it requires
Papua New Guinea	Copyright and Neighbouring Rights Act 2000, Exceptions to Copyright and Enforcement	Through its attribution duty. What it requires
Paraguay	Ley N° 1328/1998, arts. 8, 40 y 41, límites y excepciones al derecho de autor	Through its TDM duty. What it requires
Poland	Ustawa o prawie autorskim i prawach pokrewnych, Text-and-Data-Mining Exceptions	Through its TDM duty. What it requires
Romania	Legea nr. 8/1996 privind dreptul de autor și drepturile conexe, art. 36^1-36^2, Text and Data Mining Exceptions, inserted by Legea nr. 69/2022	Through its TDM duty. What it requires
United States	Digital Millennium Copyright Act, integrity of copyright management information	Through its attribution duty. What it requires
Uruguay	Ley N° 9.739 arts. 44-45, illicit-reproduction rule and free-use exceptions for quotation and news	Through its attribution duty. What it requires
Vatican City	Copyright and related rights by reference to Italian law (Legge N. CXCVII)	Through its attribution duty. What it requires

Database right

23 laws, 23 jurisdictions

Jurisdiction	Law	How it reaches this control
Albania	Copyright Law, Sui Generis Database Producers Rights	Through its access restriction duty. What it requires
Algeria	Ordonnance n° 03-05, protection des bases de données	Through its access restriction duty. What it requires
Azerbaijan	Law on Legal Protection of Compilations of Data, sui generis database right	Through its access restriction duty. What it requires
Bahamas	Copyright Act 1998, compilation and database protection	Through its attribution duty. What it requires
Belgium	Code de droit économique, livre XI, titre 7, droit des producteurs de bases de données (articles XI.305 à XI.310/1)	Through its access restriction duty. What it requires
Burkina Faso	Loi n°048-2019/AN du 12 novembre 2019 portant protection de la propriété littéraire et artistique, database and news exceptions	Through its attribution duty. What it requires
Burundi	Law No. 1/021 of December 30, 2005 on the Protection of Copyright and Related Rights, database and facts exclusions	Through its attribution duty. What it requires
Cayman Islands	Copyright (Cayman Islands) Order 2015, database and compilation copyright	Through its attribution duty. What it requires
Czech Republic	Autorský zákon Sections 88-94, Sui Generis Database Right	Through its access restriction duty. What it requires
Ethiopia	Copyright and Neighbouring Rights Protection Proclamation, Database Protection	Through its access restriction duty. What it requires

Show the other 13 laws

Gabon	Loi n°1/87, protection des recueils et compilations	Through its access restriction, attribution duties. What it requires
Georgia	Copyright and Related Rights, database producer right	Through its access restriction duty. What it requires
Ghana	Copyright Act, Database Protection	Through its access restriction duty. What it requires
Guatemala	Ley de Derecho de Autor y Derechos Conexos, Decreto 33-98 (compilations, databases, and technological measures)	Through its access restriction duty. What it requires
Latvia	Autortiesību likums Chapter IX, Sui Generis Database Right	Through its access restriction duty. What it requires
Lithuania	Law on Copyright and Related Rights (Nr. VIII-1185), Articles 61 to 64, Database Makers' Sui Generis Rights	Through its access restriction duty. What it requires
Montenegro	Law on Copyright and Related Rights, Rights of Makers of Databases	Through its access restriction duty. What it requires
Nepal	Copyright Act, 2059, database compilation protection and digital reproduction limit	Through its access restriction duty. What it requires
Nicaragua	Ley No. 312, protection of compilations and databases	Through its attribution duty. What it requires
Poland	Ustawa o ochronie baz danych, Sui Generis Database Right	Through its access restriction duty. What it requires
Samoa	Copyright Act 1998, compilation-only protection of collections and databases	Through its access restriction duty. What it requires
Sao Tome and Principe	Decreto-Lei n.º 02/2017, protecção de compilações e exclusão das notícias do dia	Through its access restriction, attribution duties. What it requires
Slovakia	Autorský zákon, Special Right to a Database (Sections 135 to 139)	Through its access restriction duty. What it requires

Snippet reproduction

19 laws, 19 jurisdictions

Jurisdiction	Law	How it reaches this control
Algeria	Ordonnance n° 03-05, exception de citation	Through its access restriction, attribution duties. What it requires
Andorra	Copyright and Neighboring Rights Law, Press and Current-Events Reproduction Exception	Through its attribution duty. What it requires
Bahamas	Copyright Act 1998, fair dealing for reporting current events and criticism	Through its attribution duty. What it requires
Belarus	Law on Copyright and Related Rights, Free Use of Press Articles and Quotation	Through its attribution duty. What it requires
Bermuda	Copyright and Designs Act 2004, fair dealing for criticism, review and reporting current events	Through its attribution duty. What it requires
Comoros	Law on Literary and Artistic Property, quotation and press-review exception	Through its attribution duty. What it requires
Cook Islands	Copyright Act 2013, quoting and current-events reporting exceptions	Through its attribution duty. What it requires
Cuba	Ley 154/2022, De los Derechos del Autor y del Artista Intérprete, article 86, uses allowed without authorization or payment	Through its attribution duty. What it requires
Honduras	Ley del Derecho de Autor, reproducción de artículos de actualidad	Through its attribution duty. What it requires
Libya	Law No. 9 of 1968, quotation and newspaper-reproduction exceptions	Through its attribution duty. What it requires

Show the other 9 laws

Maldives	Copyright and Related Rights Act, quotation and current-events reproduction exceptions	Through its attribution duty. What it requires
Nauru	Copyright Act 2019, news and current-events exceptions to copyright	Through its attribution duty. What it requires
Nicaragua	Ley No. 312, quotation and press-reproduction limitations	Through its attribution duty. What it requires
Puerto Rico	Ley de Derechos Morales de Autor de Puerto Rico, news and criticism exception	Through its attribution duty. What it requires
Sao Tome and Principe	Decreto-Lei n.º 02/2017, exclusão das notícias do dia, revista de imprensa e citação	Through its access restriction, attribution duties. What it requires
Seychelles	Copyright Act, news reproduction and press-article exceptions	Through its attribution duty. What it requires
State of Palestine	Copyright Act, 1911 (Extension to Palestine) Order, 1924, Fair Dealing Exception	Through its attribution duty. What it requires
Tonga	Copyright Act 2002, Reproduction of Newspaper Articles and Quotation Exceptions	Through its attribution duty. What it requires
Tunisia	Copyright Act, Facts Exclusion and Quotation and Press-Review Exception	Through its attribution duty. What it requires

Press publishers' right

6 laws, 6 jurisdictions

Jurisdiction	Law	How it reaches this control
Bulgaria	Copyright and Neighbouring Rights Act (ZAPSP), Arts. 90d and 90zh, Press Publisher Right	Through its attribution duty. What it requires
European Union	Directive (EU) 2019/790 on copyright and related rights in the Digital Single Market (DSM Directive), Articles 15 and 4	Through its TDM, attribution duties. What it requires
Germany	Presseverleger-Leistungsschutzrecht (Press Publisher Neighbouring Right)	Through its attribution duty. What it requires
Greece	Law 2121/1993 Article 51B, Press Publisher Neighbouring Right	Through its attribution duty. What it requires
Italy	Legge sul Diritto d'Autore Art. 43-bis, Press Publisher Neighbouring Right	Through its attribution duty. What it requires
Malta	Copyright and Related Rights in the Digital Single Market Regulations (S.L. 415.08), Regulation 15, Press Publishers' Right	Through its attribution duty. What it requires

AI risk obligations

5 laws, 3 jurisdictions

Jurisdiction	Law	How it reaches this control
California	CCPA Automated Decisionmaking Technology Regulations	Through its data subject rights duty. What it requires
European Union	AI Act, Article 14 (human oversight) from 2 Dec 2027, in 13 months	Through its biometric duty. What it requires
European Union	AI Act, Article 26(10) (post-remote biometric identification authorisation) from 2 Dec 2027, in 13 months	Through its biometric duty. What it requires
European Union	AI Act, Article 86 (right to explanation of individual decision-making) from 2 Dec 2027, in 13 months	Through its data subject rights duty. What it requires
Italy	Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10)	Through its biometric duty. What it requires

AI prohibited practices

4 laws, 4 jurisdictions

Jurisdiction	Law	How it reaches this control
Florida	Promotion of an Altered Sexual Depiction; Brooke's Law platform takedown duty	Through its data subject rights duty. What it requires
Italy	Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13)	Through its biometric duty. What it requires
Michigan	Leading Ethical AI Development for Kids Act (Senate Bill 760, as passed by the Senate) proposed	Through its consent duty. What it requires
Utah	Digital Voyeurism Prevention Act (HB 276, 2026 General Session), Utah Code Title 13 Chapter 72b from 1 Jan 2027, in 7 weeks	Through its consent duty. What it requires

AI sector rules

4 laws, 4 jurisdictions

Jurisdiction	Law	How it reaches this control
Colorado	HB 26-1195 (2026), Psychotherapy Artificial Intelligence Restrictions	Through its consent duty. What it requires
Croatia	Consumer Credit Act, Articles 24 and 30, Personalised Offers and Creditworthiness Assessment by Automated Processing from 20 Nov 2026, in 6 days	Through its data subject rights duty. What it requires
Illinois	Wellness and Oversight for Psychological Resources Act	Through its consent duty. What it requires
Sweden	Consumer Credit Act (2026:1011), Chapter 2 Section 7 and Chapter 3 Section 15, Personalised Offers and Credit Assessment by Automated Processing from 20 Nov 2026, in 6 days	Through its data subject rights duty. What it requires

AI transparency

2 laws, 2 jurisdictions

Jurisdiction	Law	How it reaches this control
Illinois	Artificial Intelligence Video Interview Act	Through its consent duty. What it requires
New York City	Chatbot Data Privacy, Security, and Transparency proposed	Through its consent duty. What it requires

Personal data

2 laws, 2 jurisdictions

Jurisdiction	Law	How it reaches this control
Central African Republic	Loi n° 24.001 portant protection des données à caractère personnel, collecte de données publiquement accessibles et transfert transfrontalier	Through its biometric, consent duties. What it requires
Colombia	Código Penal, Violación de Datos Personales	Through its access restriction duty. What it requires

AI governance

1 law, 1 jurisdiction

Jurisdiction	Law	How it reaches this control
European Union	Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act	Through its TDM duty. What it requires

AI training data

1 law, 1 jurisdiction

Jurisdiction	Law	How it reaches this control
European Union	AI Act, Article 53 (obligations for providers of general-purpose AI models)	Through its TDM duty. What it requires

Copyright: the exclusive rights

1 law, 1 jurisdiction

Jurisdiction	Law	How it reaches this control
Japan	Copyright Act, Right of Reproduction, Right to Transmit to the Public, Right to Demand an Injunction and penalties	Through its attribution duty. What it requires

Full text of the MIT AI Risk Mitigation Taxonomy, CC BY 4.0. MIT AI Risk Initiative (MIT FutureTech), AI Risk Mitigation Taxonomy. Data from the MIT AI Risk Initiative is licensed under CC BY 4.0. Cite as: Mapping AI Risk Mitigations: Evidence Scan & Draft Mitigation Taxonomy Every control of the framework.