Law / Frameworks / MIT mitigations Draft / Transparency & Accountability Controls

MIT mitigations 4.3Incident Reporting

Formal processes and protocols that document and share AI safety incidents, security breaches, near-misses, and relevant threat intelligence with appropriate stakeholders to enable coordinated responses and systemic improvements.MIT AI Risk Mitigation Taxonomy, preliminary taxonomy, July 2025, 4.3

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of 14 Nov 2026.

The kinds of duty that reach it: breach notice, reporting.

26: laws
16: jurisdictions
1: with court rulings behind it
7: not yet in force
1: proposed, not law

Related controls in other frameworks the same duties, in at least two laws we track, reach both

NIST AI RMFGOVERN 1.1 Legal and regulatory requirements involving AI are understood, managed, and..., 15 laws
NIST AI RMFMANAGE 4.3 Incidents and errors are communicated to relevant AI actors, including..., 8 laws
NIST AI RMFGOVERN 4.2 Organizational teams document the risks and potential impacts of the AI..., 7 laws
1 more in the NIST AI RMF
NIST AI 600-1GAI-RISK-09 Information Security, 26 laws
NIST AI 600-1GAI-RISK-07 Human-AI Configuration, 16 laws
NIST AI 600-1GAI-RISK-08 Information Integrity, 5 laws
NIST AI 200-22.3 Apply & Measure, 12 laws
NIST AI 200-24.3 Composing a TEVV Toolbox, 12 laws
OWASP LLM Top 10LLM03:2026 Excessive Agency, 12 laws
OWASP Agentic Top 10ASI09 Human-Agent Trust Exploitation, 13 laws
NIST Privacy FrameworkGV.PO-P5 Legal, regulatory, and contractual requirements regarding privacy are..., 2 laws
FINOS AIGFAIR-DET-004 AI System Observability, 26 laws
FINOS AIGFAIR-DET-021 Agent Decision Audit and Explainability, 25 laws
FINOS AIGFAIR-PREV-005 System Acceptance Testing, 12 laws
3 more in the FINOS AIGF
ETSI EN 304 2235.2.2-5 AI-specific incident management and recovery plans that are created, tested..., 26 laws
ETSI EN 304 2235.1.4-1 Capability for human oversight designed in and maintained., 12 laws
ETSI EN 304 2235.2.1-1 Full inventory of assets, including their dependencies and connections., 12 laws
5 more in the ETSI EN 304 223

A law in force is unmarked; the rest wear their state: not yet in force proposed

AI risk obligations

7 laws, 3 jurisdictions

Jurisdiction	Law	How it reaches this control
Colorado	HB 26-1139 (2026), Use of Artificial Intelligence in Health Care from 1 Jan 2027, in 7 weeks	Through its reporting duty. What it requires
European Union	AI Act, Article 20 (corrective actions and duty of information) from 2 Dec 2027, in 13 months	Through its reporting duty. What it requires
European Union	AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring) from 2 Dec 2027, in 13 months	Through its reporting duty. What it requires
European Union	AI Act, Article 26(10) (post-remote biometric identification authorisation) from 2 Dec 2027, in 13 months	Through its reporting duty. What it requires
European Union	AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent)	Through its reporting duty. What it requires
Vietnam	Law on Artificial Intelligence, incident management and reporting obligation	Through its breach notice duty. What it requires
Vietnam	Law on Artificial Intelligence, risk classification and conformity assessment	Through its reporting duty. What it requires

AI governance

6 laws, 6 jurisdictions

Jurisdiction	Law	How it reaches this control
European Union	Digital Services Act, Article 37 (independent audit of very large online platforms and search engines)	Through its reporting duty. What it requires
Germany	Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act	Through its reporting duty. What it requires
Hungary	Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings	Through its reporting duty. What it requires
Illinois	Artificial Intelligence Safety Measures Act from 1 Jan 2027, in 7 weeks	Through its reporting duty. What it requires
South Korea	AI Framework Act, Article 32 (safety-assurance duty for high-compute AI systems)	Through its reporting duty. What it requires
United States	Artificial Intelligence Risk Management and Security Act of 2026 proposed	Through its reporting duty. What it requires

AI sector rules

6 laws, 6 jurisdictions

Jurisdiction	Law	How it reaches this control
Alabama	SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization	Through its reporting duty. What it requires
California	Employment Technological Displacement Notice (SB 951) from 1 Jan 2027, in 7 weeks	Through its reporting duty. What it requires
Colorado	Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models	Through its reporting duty. What it requires
European Union	MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6)	Through its reporting duty. What it requires
Jordan	Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0	Through its reporting duty. What it requires
Mauritius	Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021	Through its reporting duty. What it requires

AI transparency

5 laws, 5 jurisdictions

Jurisdiction	Law	How it reaches this control
California	Companion Chatbot Safety and Accountability Act (SB 243)	Through its reporting duty. What it requires
Colorado	HB 26-1263 (2026), Conversational AI Service Operator Requirements	Through its reporting duty. What it requires
Gabon	Ordonnance n°0011/PR/2026, marquage des contenus générés par intelligence artificielle	Through its reporting duty. What it requires
Illinois	Artificial Intelligence Video Interview Act	Through its reporting duty. What it requires
Oregon	AI Companion Chatbot Safety Act (SB 1546) from 1 Jan 2027, in 7 weeks	Through its reporting duty. What it requires

AI prohibited practices

1 law, 1 jurisdiction

Jurisdiction	Law	How it reaches this control
Monaco	Code Pénal Arts. 294-3 to 294-4, Child Sexual Abuse Material Including Realistic and AI-Generated Depictions	Through its reporting duty. What it requires

Computer misuse

1 law, 1 jurisdiction

Jurisdiction	Law	How it reaches this control
Algeria	Loi n° 09-04 relative à la prévention et à la lutte contre les infractions liées aux technologies de l'information et de la communication	Through its reporting duty. What it requires

Full text of the MIT AI Risk Mitigation Taxonomy, CC BY 4.0. MIT AI Risk Initiative (MIT FutureTech), AI Risk Mitigation Taxonomy. Data from the MIT AI Risk Initiative is licensed under CC BY 4.0. Cite as: Mapping AI Risk Mitigations: Evidence Scan & Draft Mitigation Taxonomy Every control of the framework.