Law / Frameworks / MIT mitigations / Transparency & Accountability Controls

MIT mitigations 4.1System Documentation

Comprehensive documentation protocols that record technical specifications, intended uses, capabilities, and limitations of AI systems to enable informed evaluation and governance.MIT AI Risk Mitigation Taxonomy, preliminary taxonomy, July 2025, 4.1

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Corpus as of 29 Sep 2026.

The kinds of duty that reach it: TDM, disclosure, governance, retention.

91: laws
60: places
1: with court rulings behind it
24: not yet in force
9: proposed, not law

The same ground elsewhere linked through the kinds of duty both controls are mapped from

NIST AI RMFGOVERN 1.1 Legal and regulatory requirements involving AI are understood, managed, and documented.
NIST AI RMFGOVERN 1.4 The risk management process and its outcomes are established through transparent...
NIST AI 600-1GAI-RISK-07 Human-AI Configuration
NIST AI 600-1GAI-RISK-04 Data Privacy
OWASP LLM Top 10LLM03:2026 Excessive Agency
OWASP Agentic Top 10ASI09 Human-Agent Trust Exploitation
NIST Privacy FrameworkGV.PO-P1 Organizational privacy values and policies (e.g., conditions on data processing such...
NIST Privacy FrameworkCT.DM-P8 Audit/log records are determined, documented, implemented, and reviewed in accordance...
NIST CSF 2.0ID.AM-07 Inventories of data and corresponding metadata for designated data types are maintained
NIST CSF 2.0PR.PS-04 Log records are generated and made available for continuous monitoring

A law in force is unmarked; the rest wear their state: not yet in force proposed

AI transparency

29 laws, 26 places

Place	Law	How it reaches this control
Alabama	Distribution of Materially Deceptive Media to Influence an Upcoming Election	Through its disclosure duty. What it requires
Belize	Practice Direction No. 18 of 2025, ethical use of generative AI in court proceedings	Through its disclosure duty. What it requires
California	California AI Transparency Act (SB 942, as amended by AB 853)	Through its disclosure duty. What it requires
California	Companion Chatbot Safety and Accountability Act (SB 243)	Through its disclosure duty. What it requires
Delaware	House Bill 306 (pending), Computer Communication Act proposed	Through its disclosure duty. What it requires
European Union	AI Act, Article 50 (transparency obligations for AI systems and synthetic content)	Through its disclosure duty. What it requires
Idaho	Generative Artificial Intelligence in Education Act, vendor disclosure duty	Through its disclosure duty. What it requires
Illinois	Artificial Intelligence Video Interview Act	Through its disclosure duty. What it requires
Indiana	Use of Digitally Altered Media in Elections (House Enrolled Act 1133, 2024)	Through its disclosure duty. What it requires
Jamaica	Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings	Through its disclosure, governance duties. What it requires

Show the other 19 laws

Kentucky	Synthetic Media Disclosure in Electioneering Communications	Through its disclosure duty. What it requires
Kyrgyzstan	Digital Code, Chapter 23: AI interaction and deepfake disclosure duties	Through its disclosure duty. What it requires
Louisiana	Act 250 (HB 178), attorney duty to verify and disclose AI-generated evidence	Through its disclosure duty. What it requires
Michigan	AI-Generated Political Advertisement and Robocall Disclosure (Public Act 263 of 2023)	Through its disclosure duty. What it requires
Nebraska	Conversational Artificial Intelligence Safety Act (LB 525, §§ 12-18) from 1 Jul 2027, in 9 months	Through its disclosure duty. What it requires
Nevada	AB 73 (2025), AI-manipulated media disclosure in paid political communications	Through its disclosure duty. What it requires
New Mexico	HB 182 (2024), AI-generated and manipulated media disclosure and disclaimer requirements in campaign advertising	Through its disclosure duty. What it requires
North Dakota	House Bill 1167 (2025), AI-generated political content disclosure	Through its disclosure duty. What it requires
Ohio	S.B. 163, AI-Generated Content Watermark and Provenance Mandate proposed	Through its disclosure duty. What it requires
Oregon	AI Companion Chatbot Safety Act (SB 1546) from a date not yet set	Through its disclosure duty. What it requires
Oregon	Campaign communication disclosure of synthetic media (SB 1571)	Through its disclosure duty. What it requires
Pennsylvania	S.B. 1090, SAFECHAT Act proposed	Through its disclosure duty. What it requires
Puerto Rico	AI disclosure in political advertising and electoral communications	Through its disclosure duty. What it requires
Texas	TRAIGA (H.B. 149, 2025), consumer AI-interaction disclosure duty	Through its disclosure duty. What it requires
Turkey	Commercial Advertising Regulation, AI Disclosure Duty	Through its disclosure duty. What it requires
United States	AI Labeling Act of 2026 proposed	Through its disclosure duty. What it requires
United States	FCC AI Political Ad Disclosure Rulemaking, Docket 24-211 proposed	Through its disclosure duty. What it requires
Utah	Digital Content Provenance Standards Act (HB 276, 2026 General Session), Utah Code Title 13 Chapter 72c from 1 Jan 2027, in 3 months	Through its disclosure duty. What it requires
Vermont	Vermont Synthetic Media in Elections Act	Through its disclosure duty. What it requires

AI risk obligations

20 laws, 12 places

Place	Law	How it reaches this control
California	CCPA Automated Decisionmaking Technology Regulations	Through its disclosure duty. What it requires
El Salvador	Resolución ANIA 0001/2025, registro obligatorio para decisiones consecuenciales	Through its governance duty. What it requires
European Union	AI Act, Article 10 (data and data governance) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 111(2) (2030 compliance deadline for public-authority-intended systems) from 2 Aug 2030, in 3.8 years	Through its governance duty. What it requires
European Union	AI Act, Article 14 (human oversight) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 26(10) (post-remote biometric identification authorisation) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 26(11) (informing individuals subject to an Annex III decision) from 2 Dec 2027, in 14 months	Through its disclosure duty. What it requires
European Union	AI Act, Article 26(7) (informing workers before workplace use) from 2 Dec 2027, in 14 months	Through its disclosure duty. What it requires
European Union	AI Act, Article 6(3) and (4) (narrow-task derogation from Annex III high-risk classification) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires

Show the other 10 laws

European Union	AI Act, Article 9 (risk management system) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
Georgia	Council of Europe Framework Convention on AI, Georgia's signature proposed	Through its disclosure duty. What it requires
Indiana	Downcoding of Health Benefits Claims, automated and AI decision-making (House Enrolled Act 1271, 2026)	Through its disclosure, governance duties. What it requires
Kyrgyzstan	Digital Code, Chapter 23: AI system design and risk-management obligations	Through its governance duty. What it requires
Malta	Artificial Intelligence (Designation of the Information and Data Protection Commissioner for the purposes of Regulation (EU) 2024/1689) Regulations, 2025 (L.N. 227 of 2025)	Through its governance duty. What it requires
Montana	Right to Compute Act (SB 212, 2025), critical AI infrastructure risk management duty	Through its governance duty. What it requires
Nebraska	Ensuring Transparency in Prior Authorization Act, artificial-intelligence utilization review restriction	Through its disclosure duty. What it requires
Peru	Reglamento de la Ley 31814, high-risk AI system duties	Through its disclosure duty. What it requires
South Korea	AI Framework Act, Article 34 (business-operator duties for high-impact AI)	Through its disclosure, governance duties. What it requires
Vietnam	Law on Artificial Intelligence, risk classification and conformity assessment	Through its governance duty. What it requires

Copyright and text and data mining (TDM)

15 laws, 15 places

Place	Law	How it reaches this control
Belgium	Code de droit économique, article XI.190, 20°, exception de fouille de textes et de données	Through its TDM duty. What it requires
Bosnia and Herzegovina	Law on Copyright and Related Rights, Content Limitations (No Text-and-Data-Mining Exception)	Through its TDM duty. What it requires
Bulgaria	Copyright and Neighbouring Rights Act (ZAPSP), Arts. 26e, 26zh and 26k, Text-and-Data-Mining Exception for Crawling and Training	Through its TDM duty. What it requires
Cayman Islands	Copyright (Cayman Islands) Order 2015, text and data analysis exception	Through its TDM duty. What it requires
Cook Islands	Copyright Act 2013, economic rights, computer program copying, and technological protection measures	Through its TDM duty. What it requires
Czech Republic	Autorský zákon Sections 39c-39d, Text and Data Mining Exception for Automated Analysis	Through its TDM duty. What it requires
European Union	DSM Directive, Article 4 (text-and-data-mining exception and rights reservation)	Through its TDM duty. What it requires
Fiji	Copyright Act 1999, Fair Dealing and Criminal Liability for Infringement from a date not yet set	Through its TDM duty. What it requires
Georgia	Copyright and Related Rights, no text-and-data-mining exception	Through its TDM duty. What it requires
Honduras	Ley del Derecho de Autor, sin excepción de minería de textos y datos, protección de compilaciones	Through its TDM duty. What it requires

Show the other 5 laws

Italy	Legge sul Diritto d'Autore Artt. 70-ter and 70-quater, Text-and-Data-Mining Exceptions	Through its TDM duty. What it requires
Latvia	Autortiesību likums Article 21.1, Text and Data Mining Exception (Scraping and AI Training)	Through its TDM duty. What it requires
Paraguay	Ley N° 1328/1998, arts. 8, 40 y 41, límites y excepciones al derecho de autor	Through its TDM duty. What it requires
Poland	Ustawa o prawie autorskim i prawach pokrewnych, Text-and-Data-Mining Exceptions	Through its TDM duty. What it requires
Romania	Legea nr. 8/1996 privind dreptul de autor și drepturile conexe, art. 36^1-36^2, Text and Data Mining Exceptions, inserted by Legea nr. 69/2022	Through its TDM duty. What it requires

AI governance

14 laws, 11 places

Place	Law	How it reaches this control
Andorra	Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra proposed	Through its disclosure duty. What it requires
Armenia	Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia proposed	Through its disclosure duty. What it requires
California	Transparency in Frontier Artificial Intelligence Act (SB 53)	Through its disclosure, governance duties. What it requires
European Union	AI Act, Article 12 (record-keeping) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 19 (automatically generated logs) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 21(2) (competent authority access to automatically generated logs) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 26(6) (deployer log-keeping) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
Germany	Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act	Through its governance duty. What it requires
Hungary	Act LXXV of 2025 on the Domestic Implementation of the EU AI Regulation	Through its governance duty. What it requires
Illinois	Artificial Intelligence Safety Measures Act from 1 Jan 2027, in 3 months	Through its disclosure, governance duties. What it requires

Show the other 4 laws

Moldova	Council of Europe Framework Convention on Artificial Intelligence, signed by Moldova proposed	Through its disclosure duty. What it requires
Russia	Federal Law No. 243-FZ, Article 8, Duties of Sovereign and National Foundation Model Developers from 1 Mar 2027, in 5 months	Through its governance duty. What it requires
Vanuatu	Digital Transformation Act 2025, ICT service permit for AI and AI-related data services	Through its governance duty. What it requires
Vatican City	Guidelines on Artificial Intelligence of Vatican City State (Decree No. DCCII)	Through its governance duty. What it requires

AI sector rules

11 laws, 11 places

Place	Law	How it reaches this control
Alabama	SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization from 1 Oct 2026, in 2 days	Through its disclosure, governance duties. What it requires
California	Healthcare AI Patient-Communication Disclosure Act (AB 3030)	Through its disclosure duty. What it requires
Colorado	Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models	Through its governance duty. What it requires
Georgia	Private Review Agent Artificial Intelligence Coverage Determinations Act (SB 444) from 1 Jan 2027, in 3 months	Through its governance duty. What it requires
Illinois	Illinois Human Rights Act, use of artificial intelligence in employment decisions	Through its disclosure duty. What it requires
Maine	Use of artificial intelligence in therapy or psychotherapy services from a date not yet set	Through its governance duty. What it requires
Minnesota	Utilization Review, AI-Only Adverse Determination Prohibition from 1 Jan 2027, in 3 months	Through its governance duty. What it requires
Nevada	AB 406 (2025), licensed provider restriction on direct clinical use of AI	Through its governance duty. What it requires
Ontario	Employment Standards Act, 2000, use of artificial intelligence in job postings	Through its disclosure duty. What it requires
Texas	S.B. 1188 (2025), AI diagnostic disclosure duty in electronic health records	Through its disclosure duty. What it requires

Show the other 1 law

Utah

Health Insurance Preauthorization AI Disclosure (SB 319, 2026 General Session) from 1 Jan 2027, in 3 months

Through its disclosure, governance duties. What it requires

AI prohibited practices

1 law, 1 place

Place	Law	How it reaches this control
Denmark	Lov nr. 467 af 14. maj 2025, National Competent Authorities and Article 5 Enforcement	Through its governance duty. What it requires

AI training data

1 law, 1 place

Place	Law	How it reaches this control
European Union	AI Act, Article 53 (obligations for providers of general-purpose AI models)	Through its TDM, governance duties. What it requires

Full text of the MIT AI Risk Mitigation Taxonomy, CC BY 4.0. MIT AI Risk Initiative (MIT FutureTech), AI Risk Mitigation Taxonomy, https://airisk.mit.edu/ai-risk-mitigations. Data from the MIT AI Risk Initiative is licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Cite as: Mapping AI Risk Mitigations: Evidence Scan & Draft Mitigation Taxonomy, https://airisk.mit.edu/blog/mapping-ai-risk-mitigations Every control of the framework.