Law / Frameworks / MIT mitigations / Operational Process Controls

MIT mitigations 3.3Access Management

Operational policies and verification systems that govern who can use AI systems and for what purposes to prevent safety circumvention, deliberate misuse, and deployment in high-risk contexts.MIT AI Risk Mitigation Taxonomy, preliminary taxonomy, July 2025, 3.3

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Corpus as of 29 Sep 2026.

The kinds of duty that reach it: age verification, biometric, contract terms, prohibition.

122: laws
78: places
1: with court rulings behind it
7: not yet in force
1: blocked by a court
2: proposed, not law

The same ground elsewhere linked through the kinds of duty both controls are mapped from

NIST AI RMFMAP 3.3 Targeted application scope is specified and documented based on the system’s...
NIST AI RMFGOVERN 6.1 Policies and procedures are in place that address AI risks associated with third-party...
NIST AI 600-1GAI-RISK-04 Data Privacy
NIST AI 600-1GAI-RISK-07 Human-AI Configuration
NIST Privacy FrameworkCT.PO-P1 Policies, processes, and procedures for authorizing data processing (e.g.,...
NIST Privacy FrameworkID.IM-P3 Categories of individuals (e.g., customers, employees or prospective employees,...
NIST CSF 2.0GV.SC-02 Cybersecurity roles and responsibilities for suppliers, customers, and partners are...
NIST CSF 2.0GV.SC-05 Requirements to address cybersecurity risks in supply chains are established,...

A law in force is unmarked; the rest wear their state: not yet in force blocked by a court proposed

AI prohibited practices

101 laws, 74 places

Place	Law	How it reaches this control
Alabama	Alabama Child Protection Act of 2024, AI-Generated Child Sexual Abuse Material	Through its prohibition duty. What it requires
Arizona	AI-generated and indistinguishable depictions included in child-exploitation definitions (HB 2678)	Through its prohibition duty. What it requires
Arizona	Unlawful disclosure extended to AI-generated 'realistic pictorial representation' intimate images (SB 1462)	Through its prohibition duty. What it requires
Arkansas	Act 159 of 2025 (HB 1071), AI-Generated Replicas Amendment to Publicity Rights Act	Through its prohibition duty. What it requires
Arkansas	Act 827 of 2025 (HB 1529), Unlawful Creation or Distribution of Deepfake Visual Material	Through its prohibition duty. What it requires
Arkansas	Act 977 of 2025 (HB 1877), AI-Generated Child Sexual Abuse Material Amendments	Through its prohibition duty. What it requires
Australia	Using a Carriage Service to Transmit Sexual Material Without Consent (Deepfake Offences)	Through its prohibition duty. What it requires
Austria	StGB Section 207a(4)(4), Computer-Generated and Altered Child Sexual Abuse Material	Through its prohibition duty. What it requires
Bahamas	Sexual Offences Act, child pornography offence	Through its prohibition duty. What it requires
Bangladesh	Cyber Security Act, 2026, AI-generated sexual content and CSAM ban	Through its prohibition duty. What it requires

Show the other 91 laws

Berkeley	Prohibition on the Sale or Use of Coordinated Pricing Algorithms	Through its prohibition duty. What it requires
Bermuda	Criminal Code Act 1907, making and distributing child abusive material or child pornography	Through its prohibition duty. What it requires
Bhutan	Information, Communications and Media Act of Bhutan 2018, obscene communications depicting children	Through its prohibition duty. What it requires
Brazil	TSE Resolution, Prohibition on Electoral Deepfakes	Through its prohibition duty. What it requires
Cabo Verde	Cybercrime Law, Child Pornography Including Simulated Representations	Through its prohibition duty. What it requires
Cayman Islands	Penal Code 2019 Revision, indecent photographs and pseudo-photographs of children	Through its prohibition duty. What it requires
Colombia	Código Penal, Falsedad Personal, AI Deepfake Aggravation	Through its prohibition duty. What it requires
Comoros	Penal Code, pornographic and manipulated image or representation offenses via an information system	Through its prohibition duty. What it requires
Czech Republic	Criminal Code Section 191a, Non-Consensual Identity-Based Pornographic Depiction	Through its prohibition duty. What it requires
Czech Republic	Criminal Code Section 192, Child Pornography Including a Depiction of a Person Who Appears to Be a Child	Through its prohibition duty. What it requires
Delaware	Child sexual abuse material offenses, computer-generated depictions	Through its prohibition duty. What it requires
Delaware	House Bill 191 (2026), medical professional title protection against nonhuman and AI entities	Through its prohibition duty. What it requires
Delaware	House Bill 353 (2024), deep fake intimate images (The Amelia Kramer Act)	Through its prohibition duty. What it requires
Denmark	Lov nr. 467 af 14. maj 2025, National Competent Authorities and Article 5 Enforcement	Through its prohibition duty. What it requires
European Union	AI Act, Article 5 (prohibited AI practices)	Through its prohibition duty. What it requires
European Union	AI Act, Article 5(1)(ba) and (bb) (AI-generated non-consensual intimate imagery and child sexual abuse material) from 2 Dec 2026, in 2 months	Through its prohibition duty. What it requires
Finland	Rikoslaki Chapter 20, Distribution and Possession of an Image Depicting a Child Sexually, Including Realistic Depictions	Through its prohibition duty. What it requires
France	Code Pénal Article 226-8 as Amended, Existing Offense Extended to Algorithmically Generated Content	Through its prohibition duty. What it requires
France	Code Pénal Article 226-8-1, Non-Consensual Sexual Montage and Algorithmically Generated Sexual Content	Through its prohibition duty. What it requires
Gabon	Ordonnance n°0011/PR/2026, contenus interdits générés par intelligence artificielle	Through its prohibition duty. What it requires
Hoboken	Ord. No. B-781, Algorithmic Rent Fixing in Rental Housing Market Prohibited	Through its prohibition duty. What it requires
Hungary	Büntető Törvénykönyv (Criminal Code), Section 204(8), Realistic Depiction of a Non-Existent Person as Child Pornography	Through its prohibition duty. What it requires
Idaho	Disclosing explicit synthetic media	Through its prohibition duty. What it requires
Illinois	Child sexual abuse material, computer-generated and digitally altered depictions	Through its prohibition duty. What it requires
Illinois	Civil Remedies for Nonconsensual Dissemination of Private Sexual Images Act, digitally altered images	Through its prohibition duty. What it requires
Illinois	Right of Publicity Act, unauthorized AI digital replica prohibition	Through its prohibition duty. What it requires
Indiana	Child Exploitation and Possession of Child Pornography, obscene simulated or computer-generated images	Through its prohibition duty. What it requires
Indiana	Distribution of an Intimate Image and Civil Action for Nonconsensual Pornography, extended to AI-generated images (House Enrolled Act 1047, 2024)	Through its prohibition duty. What it requires
Iowa	Harassment, nonconsensual and synthetic intimate images	Through its prohibition duty. What it requires
Iowa	Sexual exploitation of a minor, AI-generated and manipulated depictions	Through its prohibition duty. What it requires
Jersey City	Ordinance 25-057, Preventing Algorithmic Rent-Fixing in the Rental Housing Market	Through its prohibition duty. What it requires
Jordan	Cybercrime Law, Ban on Real, Virtual, and Simulated Depictions of a Minor	Through its prohibition duty. What it requires
Kosovo	Criminal Code of the Republic of Kosovo, Articles 225 and 232 (Child Pornography, Including Computer-Generated and Non-Existent-Child Images)	Through its prohibition duty. What it requires
Latvia	Krimināllikums Sections 90.1 and 90.2, Criminalization of Deepfake Election and State-Appointment Disinformation	Through its prohibition duty. What it requires
Lithuania	Criminal Code Art. 309(2), Dealing in Child Sexual Abuse Material Including Simulated Depictions	Through its prohibition duty. What it requires
Maine	Unauthorized dissemination of certain private images (AI-generated image amendment)	Through its prohibition duty. What it requires
Mexico	Código Penal Federal, Violación a la Intimidad Sexual (Arts. 199 Octies a 199 Decies), including manipulated or non-corresponding depictions	Through its prohibition duty. What it requires
Michigan	Protection from Intimate Deep Fakes Act (Public Act 11 of 2025)	Through its prohibition duty. What it requires
Minneapolis	Prohibition on Use of Rent-Setting Algorithms (Ord. No. 2025-010)	Through its prohibition duty. What it requires
Mississippi	HB 1308 (2025), Morphed-Image Child Exploitation Amendments	Through its prohibition duty. What it requires
Monaco	Code Pénal Arts. 294-3 to 294-4, Child Sexual Abuse Material Including Realistic and AI-Generated Depictions	Through its prohibition duty. What it requires
Montana	Digital Likeness and Voice Rights Act (HB 513, 2025), unauthorized AI depiction liability	Through its prohibition duty. What it requires
Montana	Privacy in communications, digitally fabricated intimate images	Through its prohibition duty. What it requires
Montana	Sexual abuse of children, computer-generated child pornography	Through its prohibition duty. What it requires
Nebraska	Child Sexual Abuse Material Prevention Act, computer-generated and artificial-intelligence depictions	Through its prohibition duty. What it requires
Nevada	AB 406 (2025), AI mental and behavioral health care provider and marketing prohibitions	Through its prohibition duty. What it requires
Nevada	SB 213 (2025), AI-generated and digitally altered intimate images	Through its prohibition duty. What it requires
Nevada	SB 263 (2025), AI-generated and computer-generated child sexual abuse material	Through its prohibition duty. What it requires
New Jersey	Deceptive Audio or Visual Media (Deepfake) Criminalization Act	Through its prohibition duty. What it requires
New Mexico	Sexual Exploitation of Children Act, morphed and computer-generated image provisions	Through its prohibition duty. What it requires
North Carolina	AI-Generated Intimate Images and Child Sexual Abuse Material (Session Law 2024-37, HB 591)	Through its prohibition duty. What it requires
North Dakota	House Bill 1351 (2025), sexually expressive images including AI-generated or altered deepfakes	Through its prohibition duty. What it requires
North Dakota	House Bill 1429 (2025), harassment and stalking with a robot	Through its prohibition duty. What it requires
Ohio	S.B. 163, AI-Generated Child Sexual Abuse Material and Nonconsensual Replica Prohibitions proposed	Through its prohibition duty. What it requires
Oregon	Unlawful dissemination of an intimate image extended to AI-generated depictions (HB 2299)	Through its prohibition duty. What it requires
Pennsylvania	Act 125 of 2024, artificially generated child sexual abuse material	Through its prohibition duty. What it requires
Pennsylvania	Act 125 of 2024, artificially generated sexual depictions in the unlawful dissemination of intimate image offense	Through its prohibition duty. What it requires
Pennsylvania	Act 35 of 2025, digital forgery	Through its prohibition duty. What it requires
Peru	Reglamento de la Ley 31814, prohibited AI uses	Through its prohibition duty. What it requires
Philadelphia	Bill No. 240823, Anti-Competitive Rental Practices	Through its prohibition duty. What it requires
Poland	Kodeks karny art. 202 § 4b-4c, Fabricated Child Sexual Abuse Material	Through its prohibition duty. What it requires
Providence	Prohibition of Algorithmic Rent Setting Devices	Through its prohibition duty. What it requires
Rockville	Price Coordination and Algorithmic Devices from 1 Jan 2027, in 3 months	Through its prohibition duty. What it requires
Romania	Cod penal, Art. 374, Pornografia infantilă (Child Pornography, Including Simulated or Computer-Generated Depictions of Minors)	Through its prohibition duty. What it requires
Saint Kitts and Nevis	Electronic Crimes Act, child pornography, including computer-generated depictions	Through its prohibition duty. What it requires
Samoa	Crimes Act 2013, child pornography offence reaching synthetic and represented depictions	Through its prohibition duty. What it requires
San Diego	Prohibition of Anti-Competitive Automated Rent Price-Fixing Ordinance (Ord. O-21955 N.S.)	Through its prohibition duty. What it requires
San Francisco	Use and Sale of Algorithmic Devices Prohibited (Rent Ordinance Sec. 37.10C), as amended by Ord. No. 169-25	Through its prohibition duty. What it requires
Santa Monica	Algorithmic Rental Price Fixing (Ord. No. 2817 (CCS))	Through its prohibition duty. What it requires
Seattle	Ordinance 127241 (Council Bill 121000), Algorithmic Rent Fixing	Through its prohibition duty. What it requires
Slovenia	Kazenski zakonik (KZ-1, Criminal Code), Art. 176(3), Pornographic Material Involving a Minor's Realistic Likeness	Through its prohibition duty. What it requires
South Carolina	AI-Generated and Morphed Images of an Identifiable Minor (2025 Act No. 58, S.29)	Through its prohibition duty. What it requires
Sweden	Brottsbalken 16 kap. 10 a-10 b §§, Child Pornography Offence (Barnpornografibrott)	Through its prohibition duty. What it requires
Tennessee	AI-generated child sexual abuse material, tool possession and distribution offense	Through its prohibition duty. What it requires
Tennessee	Ensuring Likeness, Voice, and Image Security (ELVIS) Act	Through its prohibition duty. What it requires
Tennessee	Preventing Deepfake Images Act	Through its prohibition duty. What it requires
Texas	Political deep fake video ban (originally S.B. 751, 2019)	Through its prohibition duty. What it requires
Texas	S.B. 20 (2025), possession, promotion, or production of AI-generated or apparent child pornography	Through its prohibition duty. What it requires
Texas	S.B. 441 (2025), unlawful production or distribution of AI deep fake sexually explicit media	Through its prohibition duty. What it requires
Texas	TRAIGA (H.B. 149, 2025), prohibited AI practices binding any person	Through its prohibition duty. What it requires
Timor-Leste	Penal Code, Article 176 (Child Pornography)	Through its prohibition duty. What it requires
Turkey	Commercial Advertising Regulation, AI Deepfake Endorsement Ban	Through its prohibition duty. What it requires
Utah	Digital Voyeurism Prevention Act (HB 276, 2026 General Session), Utah Code Title 13 Chapter 72b from 1 Jan 2027, in 3 months	Through its prohibition duty. What it requires
Utah	Identity Protection Modifications, AI Defamation and Identity Replication (SB 256, 2026 General Session)	Through its prohibition duty. What it requires
Vatican City	Child sexual abuse material offences (Legge N. VIII, arts. 4, 10-11)	Through its prohibition duty. What it requires
Vermont	Disclosure of sexually explicit images without consent, digitized and computer-generated images	Through its prohibition duty. What it requires
West Virginia	SB 198 (2025), computer-generated child pornography prohibition	Through its prohibition duty. What it requires
West Virginia	SB 198 (2025), fabricated intimate image disclosure prohibition	Through its prohibition duty. What it requires
Wisconsin	2023 Wisconsin Act 224, Possession of Virtual Child Pornography	Through its prohibition duty. What it requires
Wisconsin	2025 Wisconsin Act 34, Synthetic Intimate Representation Ban	Through its prohibition duty. What it requires
Wyoming	Artificial Intelligence Offenses (2026 Wyoming House Bill 102, Enrolled Act No. 32)	Through its prohibition duty. What it requires

AI transparency

9 laws, 9 places

Place	Law	How it reaches this control
Belize	Practice Direction No. 18 of 2025, ethical use of generative AI in court proceedings	Through its prohibition duty. What it requires
California	AB 2839, election materially deceptive deepfake disclaimer law blocked by a court	Through its prohibition duty. What it requires
Delaware	House Bill 316 (2024), use of deep fake technology to influence an election	Through its prohibition duty. What it requires
Michigan	Distribution of Materially Deceptive Election Media (Public Act 265 of 2023)	Through its prohibition duty. What it requires
Mississippi	SB 2577 (2024), Wrongful Dissemination of Digitizations (Election Deepfakes)	Through its prohibition duty. What it requires
Montana	Deepfake Regulation Act (SB 25, 2025), election deepfake disclosure	Through its prohibition duty. What it requires
New Mexico	HB 182 (2024), AI-generated and manipulated media disclosure and disclaimer requirements in campaign advertising	Through its prohibition duty. What it requires
Pennsylvania	H.B. 811, civil liability for fraudulent misrepresentation of candidates by deepfake proposed	Through its prohibition duty. What it requires
Vermont	Vermont Synthetic Media in Elections Act	Through its prohibition duty. What it requires

AI sector rules

6 laws, 6 places

Place	Law	How it reaches this control
Illinois	Wellness and Oversight for Psychological Resources Act	Through its prohibition duty. What it requires
Maine	Use of artificial intelligence in therapy or psychotherapy services from a date not yet set	Through its prohibition duty. What it requires
Mexico	Reform to the Federal Labor Law and the Federal Copyright Law, AI Voice and Image Consent Regime for Performing Artists	Through its contract terms, prohibition duties. What it requires
Nevada	AB 406 (2025), licensed provider restriction on direct clinical use of AI	Through its prohibition duty. What it requires
Oregon	Use of nursing titles by a nonhuman entity (HB 2748)	Through its prohibition duty. What it requires
Tennessee	Health Care AI Act, AI mental health professional representation prohibition	Through its prohibition duty. What it requires

AI risk obligations

3 laws, 1 place

Place	Law	How it reaches this control
European Union	AI Act, Article 14 (human oversight) from 2 Dec 2027, in 14 months	Through its biometric duty. What it requires
European Union	AI Act, Article 25 (responsibilities along the AI value chain) from 2 Dec 2027, in 14 months	Through its contract terms duty. What it requires
European Union	AI Act, Article 26(10) (post-remote biometric identification authorisation) from 2 Dec 2027, in 14 months	Through its biometric duty. What it requires

AI governance

1 law, 1 place

Place	Law	How it reaches this control
Vatican City	Guidelines on Artificial Intelligence of Vatican City State (Decree No. DCCII)	Through its prohibition duty. What it requires

Computer misuse

1 law, 1 place

Place	Law	How it reaches this control
Tuvalu	Tuvalu Telecommunications Corporation Act 1993, offences and penalties	Through its prohibition duty. What it requires

Personal data

1 law, 1 place

Place	Law	How it reaches this control
Central African Republic	Loi n° 24.001 portant protection des données à caractère personnel, collecte de données publiquement accessibles et transfert transfrontalier	Through its biometric duty. What it requires

Full text of the MIT AI Risk Mitigation Taxonomy, CC BY 4.0. MIT AI Risk Initiative (MIT FutureTech), AI Risk Mitigation Taxonomy, https://airisk.mit.edu/ai-risk-mitigations. Data from the MIT AI Risk Initiative is licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Cite as: Mapping AI Risk Mitigations: Evidence Scan & Draft Mitigation Taxonomy, https://airisk.mit.edu/blog/mapping-ai-risk-mitigations Every control of the framework.