Law / Frameworks / Crosswalk / MIT mitigations to FINOS AIGF

The MIT AI Risk Mitigation Taxonomy, mapped to the FINOS AI Governance Framework

18 of MIT mitigations' controls connect to 16 of FINOS AIGF's through 465 laws in 171 jurisdictions. Two controls connect when the same duties, in at least 2 laws we track, reach both. The connections are our own reading of the law; no framework publisher has reviewed or endorsed them.

From: MIT AI Risk Mitigation Taxonomy, preliminary taxonomy, July 2025, MIT AI Risk Initiative
To: FINOS AI Governance Framework, version 2, as maintained on October 7, 2026, FINOS
See also: FINOS AIGF to MIT mitigations, the other way · every pair in the crosswalk · law library as of 19 Oct 2026

Download this mapping, with every law behind each connection: mit-ai-risk-mitigations--finos-ai-governance-framework.csv · mit-ai-risk-mitigations--finos-ai-governance-framework.json

MIT mitigations	FINOS AIGF	Laws	Jurisdictions	Where the laws stand
1.1Board Structure & Oversight	AIR-PREV-005System Acceptance Testing	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 1.1 and AIR-PREV-005 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	AIR-PREV-006Data Quality & Classification/Sensitivity	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 1.1 and AIR-PREV-006 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 1.1 and AIR-PREV-024 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	AIR-DET-004AI System Observability	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 1.1 and AIR-DET-004 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	AIR-DET-011Human Feedback Loop for AI Systems	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 1.1 and AIR-DET-011 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	AIR-DET-021Agent Decision Audit and Explainability	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 1.1 and AIR-DET-021 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	2	2	2 in force
	The 2 laws behind 1.1 and AIR-PREV-007 Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
1.2Risk Management	AIR-PREV-005System Acceptance Testing	87	40	52 in force, 29 not yet in force, 6 proposed
	The 87 laws behind 1.2 and AIR-PREV-005 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California Council of Europe Framework Convention on Artificial Intelligence, signed by Canada, Canada proposed CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada and 77 more, every one in the free file.
	AIR-PREV-006Data Quality & Classification/Sensitivity	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 1.2 and AIR-PREV-006 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 1.2 and AIR-PREV-024 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	AIR-DET-004AI System Observability	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 1.2 and AIR-DET-004 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	AIR-DET-011Human Feedback Loop for AI Systems	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 1.2 and AIR-DET-011 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	AIR-DET-021Agent Decision Audit and Explainability	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 1.2 and AIR-DET-021 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	2	2	2 in force
	The 2 laws behind 1.2 and AIR-PREV-007 Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
1.5Safety Decision Frameworks	AIR-PREV-005System Acceptance Testing	143	86	124 in force, 15 not yet in force, 1 blocked by a court, 3 proposed
1.5Safety Decision Frameworks	The 143 laws behind 1.5 and AIR-PREV-005 Alabama Child Protection Act of 2024, AI-Generated Child Sexual Abuse Material, Alabama AI-generated and indistinguishable depictions included in child-exploitation definitions (HB 2678), Arizona Unlawful disclosure extended to AI-generated 'realistic pictorial representation' intimate images (SB 1462), Arizona Act 159 of 2025 (HB 1071), AI-Generated Replicas Amendment to Publicity Rights Act, Arkansas Act 827 of 2025 (HB 1529), Unlawful Creation or Distribution of Deepfake Visual Material, Arkansas Act 977 of 2025 (HB 1877), AI-Generated Child Sexual Abuse Material Amendments, Arkansas Using a Carriage Service to Transmit Sexual Material Without Consent (Deepfake Offences), Australia StGB Section 207a(4)(4), Computer-Generated and Altered Child Sexual Abuse Material, Austria Sexual Offences Act, child pornography offence, Bahamas Cyber Security Act, 2026, AI-generated sexual content and CSAM ban, Bangladesh and 133 more, every one in the free file.
1.7Societal Impact Assessment	AIR-PREV-005System Acceptance Testing	13	11	6 in force, 2 not yet in force, 5 proposed
1.7Societal Impact Assessment	The 13 laws behind 1.7 and AIR-PREV-005 Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Canada, Canada proposed Ley de Fomento a la Inteligencia Artificial y Tecnologías, marco institucional, registro y evaluación de riesgos, El Salvador AI Act, Article 26(9) (using Article 13 information for a data protection impact assessment), European Union from 2 Dec 2027, in 13 months AI Act, Article 27 (fundamental rights impact assessment), European Union from 2 Dec 2027, in 13 months Act XLVII of 1997 on Health Data, Section 35/A(4) to (8), Conditions for AI Development on Electronic Health Service Space Data, Hungary Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan and 3 more, every one in the free file.
2.1Model & Infrastructure Security	AIR-PREV-018Agent Authority Least Privilege Framework	145	107	142 in force, 3 not yet in force
	The 145 laws behind 2.1 and AIR-PREV-018 Penal Code, Part Twelve, Chapter One (Cyber Crimes and Punishment), Afghanistan Alabama Digital Crime Act, Computer Tampering, Alabama Criminal mischief in the fourth degree, unauthorized computer access, Alaska Criminal use of a computer, Alaska Theft of services, unauthorized use of a computer system, Alaska Copyright Law, Sui Generis Database Producers Rights, Albania Criminal Code, Unauthorized Computer Access, Albania Code pénal, atteintes aux systèmes de traitement automatisé de données, Algeria Ordonnance n° 03-05, exception de citation, Algeria Ordonnance n° 03-05, protection des bases de données, Algeria and 135 more, every one in the free file.
	AIR-PREV-023Agentic System Credential Protection Framework	145	107	142 in force, 3 not yet in force
	The 145 laws behind 2.1 and AIR-PREV-023 Penal Code, Part Twelve, Chapter One (Cyber Crimes and Punishment), Afghanistan Alabama Digital Crime Act, Computer Tampering, Alabama Criminal mischief in the fourth degree, unauthorized computer access, Alaska Criminal use of a computer, Alaska Theft of services, unauthorized use of a computer system, Alaska Copyright Law, Sui Generis Database Producers Rights, Albania Criminal Code, Unauthorized Computer Access, Albania Code pénal, atteintes aux systèmes de traitement automatisé de données, Algeria Ordonnance n° 03-05, exception de citation, Algeria Ordonnance n° 03-05, protection des bases de données, Algeria and 135 more, every one in the free file.
	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	10	7	9 in force, 1 not yet in force
	The 10 laws behind 2.1 and AIR-PREV-007 Ordonnance n° 03-05, exception de citation, Algeria Copyright Act 2013, economic rights, computer program copying, and technological protection measures, Cook Islands AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Loi n°1/87, exception de courte citation et revue de presse, Gabon Loi n°1/87, protection des recueils et compilations, Gabon Schutz technischer Massnahmen und Durchsetzung von Schrankenbestimmungen (Protection of Technological Measures), Germany Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy Decreto-Lei n.º 02/2017, exclusão das notícias do dia, revista de imprensa e citação, Sao Tome and Principe Decreto-Lei n.º 02/2017, protecção de compilações e exclusão das notícias do dia, Sao Tome and Principe
	AIR-DET-013Providing Citations and Source Traceability for AI-Generated Information	5	3	5 in force
	The 5 laws behind 2.1 and AIR-DET-013 Ordonnance n° 03-05, exception de citation, Algeria Loi n°1/87, exception de courte citation et revue de presse, Gabon Loi n°1/87, protection des recueils et compilations, Gabon Decreto-Lei n.º 02/2017, exclusão das notícias do dia, revista de imprensa e citação, Sao Tome and Principe Decreto-Lei n.º 02/2017, protecção de compilações e exclusão das notícias do dia, Sao Tome and Principe
	AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems	3	2	2 in force, 1 not yet in force
	The 3 laws behind 2.1 and AIR-PREV-008 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-PREV-012Role-Based Access Control for AI Data	3	2	2 in force, 1 not yet in force
	The 3 laws behind 2.1 and AIR-PREV-012 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-PREV-014Encryption of AI Data at Rest	3	2	2 in force, 1 not yet in force
	The 3 laws behind 2.1 and AIR-PREV-014 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-PREV-017AI Firewall Implementation and Management	3	2	2 in force, 1 not yet in force
	The 3 laws behind 2.1 and AIR-PREV-017 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-PREV-020MCP Server Security Governance	3	2	2 in force, 1 not yet in force
	The 3 laws behind 2.1 and AIR-PREV-020 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-DET-001AI Data Leakage Prevention and Detection	3	2	2 in force, 1 not yet in force
	The 3 laws behind 2.1 and AIR-DET-001 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
2.3Model Safety Engineering	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	3	2	2 in force, 1 not yet in force
	The 3 laws behind 2.3 and AIR-PREV-007 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems	3	2	2 in force, 1 not yet in force
	The 3 laws behind 2.3 and AIR-PREV-008 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-PREV-012Role-Based Access Control for AI Data	3	2	2 in force, 1 not yet in force
	The 3 laws behind 2.3 and AIR-PREV-012 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-PREV-014Encryption of AI Data at Rest	3	2	2 in force, 1 not yet in force
	The 3 laws behind 2.3 and AIR-PREV-014 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-PREV-017AI Firewall Implementation and Management	3	2	2 in force, 1 not yet in force
	The 3 laws behind 2.3 and AIR-PREV-017 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-PREV-020MCP Server Security Governance	3	2	2 in force, 1 not yet in force
	The 3 laws behind 2.3 and AIR-PREV-020 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-DET-001AI Data Leakage Prevention and Detection	3	2	2 in force, 1 not yet in force
	The 3 laws behind 2.3 and AIR-DET-001 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-DET-004AI System Observability	2	2	1 in force, 1 not yet in force
	The 2 laws behind 2.3 and AIR-DET-004 Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months
	AIR-DET-021Agent Decision Audit and Explainability	2	2	1 in force, 1 not yet in force
	The 2 laws behind 2.3 and AIR-DET-021 Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months
2.4Content Safety Controls	AIR-DET-021Agent Decision Audit and Explainability	23	19	14 in force, 5 not yet in force, 4 proposed
2.4Content Safety Controls	The 23 laws behind 2.4 and AIR-DET-021 Distribution of Materially Deceptive Media to Influence an Upcoming Election, Alabama California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), California Synthetic Performer Advertising Disclosure Act (SB 1050), California from 1 Jan 2027, in 2 months AI Act, Article 50 (transparency obligations for AI systems and synthetic content), European Union European Commission Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of the AI Act, European Union from a date not yet set Use of Digitally Altered Media in Elections (House Enrolled Act 1133, 2024), Indiana Synthetic Media Disclosure in Electioneering Communications, Kentucky Digital Code, Chapter 23: AI interaction and deepfake disclosure duties, Kyrgyzstan AI-Generated Political Advertisement and Robocall Disclosure (Public Act 263 of 2023), Michigan Conversational Artificial Intelligence Safety Act (LB 525, §§ 12-18), Nebraska from 1 Jul 2027, in 8 months and 13 more, every one in the free file.
3.1Testing & Auditing	AIR-PREV-005System Acceptance Testing	14	11	7 in force, 2 not yet in force, 5 proposed
	The 14 laws behind 3.1 and AIR-PREV-005 Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Canada, Canada proposed Ley de Fomento a la Inteligencia Artificial y Tecnologías, marco institucional, registro y evaluación de riesgos, El Salvador AI Act, Article 26(9) (using Article 13 information for a data protection impact assessment), European Union from 2 Dec 2027, in 13 months AI Act, Article 27 (fundamental rights impact assessment), European Union from 2 Dec 2027, in 13 months Act XLVII of 1997 on Health Data, Section 35/A(4) to (8), Conditions for AI Development on Electronic Health Service Space Data, Hungary Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy and 4 more, every one in the free file.
	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	3	2	2 in force, 1 not yet in force
	The 3 laws behind 3.1 and AIR-PREV-007 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems	3	2	2 in force, 1 not yet in force
	The 3 laws behind 3.1 and AIR-PREV-008 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-PREV-012Role-Based Access Control for AI Data	3	2	2 in force, 1 not yet in force
	The 3 laws behind 3.1 and AIR-PREV-012 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-PREV-014Encryption of AI Data at Rest	3	2	2 in force, 1 not yet in force
	The 3 laws behind 3.1 and AIR-PREV-014 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-PREV-017AI Firewall Implementation and Management	3	2	2 in force, 1 not yet in force
	The 3 laws behind 3.1 and AIR-PREV-017 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-PREV-020MCP Server Security Governance	3	2	2 in force, 1 not yet in force
	The 3 laws behind 3.1 and AIR-PREV-020 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-DET-001AI Data Leakage Prevention and Detection	3	2	2 in force, 1 not yet in force
	The 3 laws behind 3.1 and AIR-DET-001 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-PREV-006Data Quality & Classification/Sensitivity	2	1	2 in force
	The 2 laws behind 3.1 and AIR-PREV-006 Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	2	1	2 in force
	The 2 laws behind 3.1 and AIR-PREV-024 Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy
	AIR-DET-004AI System Observability	2	1	2 in force
	The 2 laws behind 3.1 and AIR-DET-004 Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy
	AIR-DET-011Human Feedback Loop for AI Systems	2	1	2 in force
	The 2 laws behind 3.1 and AIR-DET-011 Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy
	AIR-DET-021Agent Decision Audit and Explainability	2	1	2 in force
	The 2 laws behind 3.1 and AIR-DET-021 Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy
3.2Data Governance	AIR-PREV-018Agent Authority Least Privilege Framework	145	107	142 in force, 3 not yet in force
	The 145 laws behind 3.2 and AIR-PREV-018 Penal Code, Part Twelve, Chapter One (Cyber Crimes and Punishment), Afghanistan Alabama Digital Crime Act, Computer Tampering, Alabama Criminal mischief in the fourth degree, unauthorized computer access, Alaska Criminal use of a computer, Alaska Theft of services, unauthorized use of a computer system, Alaska Copyright Law, Sui Generis Database Producers Rights, Albania Criminal Code, Unauthorized Computer Access, Albania Code pénal, atteintes aux systèmes de traitement automatisé de données, Algeria Ordonnance n° 03-05, exception de citation, Algeria Ordonnance n° 03-05, protection des bases de données, Algeria and 135 more, every one in the free file.
	AIR-PREV-023Agentic System Credential Protection Framework	145	107	142 in force, 3 not yet in force
	The 145 laws behind 3.2 and AIR-PREV-023 Penal Code, Part Twelve, Chapter One (Cyber Crimes and Punishment), Afghanistan Alabama Digital Crime Act, Computer Tampering, Alabama Criminal mischief in the fourth degree, unauthorized computer access, Alaska Criminal use of a computer, Alaska Theft of services, unauthorized use of a computer system, Alaska Copyright Law, Sui Generis Database Producers Rights, Albania Criminal Code, Unauthorized Computer Access, Albania Code pénal, atteintes aux systèmes de traitement automatisé de données, Algeria Ordonnance n° 03-05, exception de citation, Algeria Ordonnance n° 03-05, protection des bases de données, Algeria and 135 more, every one in the free file.
	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	51	39	50 in force, 1 not yet in force
	The 51 laws behind 3.2 and AIR-PREV-007 Ordonnance n° 03-05, exception de citation, Algeria Copyright and Neighboring Rights Law, Press and Current-Events Reproduction Exception, Andorra Copyright Act 1998, compilation and database protection, Bahamas Copyright Act 1998, fair dealing for reporting current events and criticism, Bahamas Code de droit économique, article XI.190, 20°, exception de fouille de textes et de données, Belgium Copyright and Designs Act 2004, fair dealing for criticism, review and reporting current events, Bermuda Law on Copyright and Related Rights, Content Limitations (No Text-and-Data-Mining Exception), Bosnia and Herzegovina Copyright and Neighbouring Rights Act (ZAPSP), Arts. 26e, 26zh and 26k, Text-and-Data-Mining Exception for Crawling and Training, Bulgaria Copyright and Neighbouring Rights Act (ZAPSP), Arts. 90d and 90zh, Press Publisher Right, Bulgaria Loi n°048-2019/AN du 12 novembre 2019 portant protection de la propriété littéraire et artistique, database and news exceptions, Burkina Faso and 41 more, every one in the free file.
	AIR-DET-013Providing Citations and Source Traceability for AI-Generated Information	33	28	33 in force
	The 33 laws behind 3.2 and AIR-DET-013 Ordonnance n° 03-05, exception de citation, Algeria Copyright and Neighboring Rights Law, Press and Current-Events Reproduction Exception, Andorra Copyright Act 1998, compilation and database protection, Bahamas Copyright Act 1998, fair dealing for reporting current events and criticism, Bahamas Copyright and Designs Act 2004, fair dealing for criticism, review and reporting current events, Bermuda Copyright and Neighbouring Rights Act (ZAPSP), Arts. 90d and 90zh, Press Publisher Right, Bulgaria Loi n°048-2019/AN du 12 novembre 2019 portant protection de la propriété littéraire et artistique, database and news exceptions, Burkina Faso Law No. 1/021 of December 30, 2005 on the Protection of Copyright and Related Rights, database and facts exclusions, Burundi Copyright (Cayman Islands) Order 2015, database and compilation copyright, Cayman Islands Law on Literary and Artistic Property, quotation and press-review exception, Comoros and 23 more, every one in the free file.
	AIR-PREV-006Data Quality & Classification/Sensitivity	11	7	6 in force, 5 not yet in force
	The 11 laws behind 3.2 and AIR-PREV-006 CCPA Automated Decisionmaking Technology Regulations, California Loi n° 24.001 portant protection des données à caractère personnel, collecte de données publiquement accessibles et transfert transfrontalier, Central African Republic Consumer Credit Act, Articles 24 and 30, Personalised Offers and Creditworthiness Assessment by Automated Processing, Croatia from 20 Nov 2026, in 4 weeks AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Article 86 (right to explanation of individual decision-making), European Union from 2 Dec 2027, in 13 months Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Use of artificial intelligence in therapy or psychotherapy services, Maine and 1 more, every one in the free file.
	AIR-DET-021Agent Decision Audit and Explainability	11	7	6 in force, 5 not yet in force
	The 11 laws behind 3.2 and AIR-DET-021 CCPA Automated Decisionmaking Technology Regulations, California Consumer Credit Act, Articles 24 and 30, Personalised Offers and Creditworthiness Assessment by Automated Processing, Croatia from 20 Nov 2026, in 4 weeks AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Article 86 (right to explanation of individual decision-making), European Union from 2 Dec 2027, in 13 months Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Artificial Intelligence Video Interview Act, Illinois Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Use of artificial intelligence in therapy or psychotherapy services, Maine and 1 more, every one in the free file.
	AIR-PREV-005System Acceptance Testing	6	3	4 in force, 2 not yet in force
	The 6 laws behind 3.2 and AIR-PREV-005 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Use of artificial intelligence in therapy or psychotherapy services, Maine
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	6	3	4 in force, 2 not yet in force
	The 6 laws behind 3.2 and AIR-PREV-024 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Use of artificial intelligence in therapy or psychotherapy services, Maine
	AIR-DET-004AI System Observability	6	3	4 in force, 2 not yet in force
	The 6 laws behind 3.2 and AIR-DET-004 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Use of artificial intelligence in therapy or psychotherapy services, Maine
	AIR-DET-011Human Feedback Loop for AI Systems	6	3	4 in force, 2 not yet in force
	The 6 laws behind 3.2 and AIR-DET-011 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Use of artificial intelligence in therapy or psychotherapy services, Maine
3.3Access Management	AIR-PREV-005System Acceptance Testing	147	87	126 in force, 17 not yet in force, 1 blocked by a court, 3 proposed
	The 147 laws behind 3.3 and AIR-PREV-005 Alabama Child Protection Act of 2024, AI-Generated Child Sexual Abuse Material, Alabama AI-generated and indistinguishable depictions included in child-exploitation definitions (HB 2678), Arizona Unlawful disclosure extended to AI-generated 'realistic pictorial representation' intimate images (SB 1462), Arizona Act 159 of 2025 (HB 1071), AI-Generated Replicas Amendment to Publicity Rights Act, Arkansas Act 827 of 2025 (HB 1529), Unlawful Creation or Distribution of Deepfake Visual Material, Arkansas Act 977 of 2025 (HB 1877), AI-Generated Child Sexual Abuse Material Amendments, Arkansas Using a Carriage Service to Transmit Sexual Material Without Consent (Deepfake Offences), Australia StGB Section 207a(4)(4), Computer-Generated and Altered Child Sexual Abuse Material, Austria Sexual Offences Act, child pornography offence, Bahamas Cyber Security Act, 2026, AI-generated sexual content and CSAM ban, Bangladesh and 137 more, every one in the free file.
	AIR-PREV-006Data Quality & Classification/Sensitivity	5	3	3 in force, 2 not yet in force
	The 5 laws behind 3.3 and AIR-PREV-006 Loi n° 24.001 portant protection des données à caractère personnel, collecte de données publiquement accessibles et transfert transfrontalier, Central African Republic AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy
	AIR-DET-021Agent Decision Audit and Explainability	5	3	2 in force, 3 not yet in force
	The 5 laws behind 3.3 and AIR-DET-021 Attorney, Court Filing and Arbitrator Generative AI Duties (SB 574), California from 1 Jan 2027, in 2 months AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	4	2	2 in force, 2 not yet in force
	The 4 laws behind 3.3 and AIR-PREV-024 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy
	AIR-DET-004AI System Observability	4	2	2 in force, 2 not yet in force
	The 4 laws behind 3.3 and AIR-DET-004 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy
	AIR-DET-011Human Feedback Loop for AI Systems	4	2	2 in force, 2 not yet in force
	The 4 laws behind 3.3 and AIR-DET-011 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy
	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	2	2	1 in force, 1 not yet in force
	The 2 laws behind 3.3 and AIR-PREV-007 AI Act, Article 25 (responsibilities along the AI value chain), European Union from 2 Dec 2027, in 13 months Reform to the Federal Labor Law and the Federal Copyright Law, AI Voice and Image Consent Regime for Performing Artists, Mexico
3.5Post-deployment Monitoring	AIR-PREV-005System Acceptance Testing	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 3.5 and AIR-PREV-005 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	AIR-PREV-006Data Quality & Classification/Sensitivity	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 3.5 and AIR-PREV-006 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 3.5 and AIR-PREV-024 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	AIR-DET-004AI System Observability	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 3.5 and AIR-DET-004 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	AIR-DET-011Human Feedback Loop for AI Systems	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 3.5 and AIR-DET-011 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	AIR-DET-021Agent Decision Audit and Explainability	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 3.5 and AIR-DET-021 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	2	2	2 in force
	The 2 laws behind 3.5 and AIR-PREV-007 Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
3.6Incident Response & Recovery	AIR-DET-001AI Data Leakage Prevention and Detection	4	3	3 in force, 1 not yet in force
	The 4 laws behind 3.6 and AIR-DET-001 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy Law on Artificial Intelligence, incident management and reporting obligation, Vietnam
	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	3	2	2 in force, 1 not yet in force
	The 3 laws behind 3.6 and AIR-PREV-007 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems	3	2	2 in force, 1 not yet in force
	The 3 laws behind 3.6 and AIR-PREV-008 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-PREV-012Role-Based Access Control for AI Data	3	2	2 in force, 1 not yet in force
	The 3 laws behind 3.6 and AIR-PREV-012 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-PREV-014Encryption of AI Data at Rest	3	2	2 in force, 1 not yet in force
	The 3 laws behind 3.6 and AIR-PREV-014 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-PREV-017AI Firewall Implementation and Management	3	2	2 in force, 1 not yet in force
	The 3 laws behind 3.6 and AIR-PREV-017 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-PREV-020MCP Server Security Governance	3	2	2 in force, 1 not yet in force
	The 3 laws behind 3.6 and AIR-PREV-020 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-DET-004AI System Observability	2	2	2 in force
	The 2 laws behind 3.6 and AIR-DET-004 Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy Law on Artificial Intelligence, incident management and reporting obligation, Vietnam
4.1System Documentation	AIR-DET-021Agent Decision Audit and Explainability	133	61	81 in force, 39 not yet in force, 13 proposed
	The 133 laws behind 4.1 and AIR-DET-021 Distribution of Materially Deceptive Media to Influence an Upcoming Election, Alabama SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Practice Direction No. 18 of 2025, ethical use of generative AI in court proceedings, Belize Attorney, Court Filing and Arbitrator Generative AI Duties (SB 574), California from 1 Jan 2027, in 2 months California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), California CCPA Automated Decisionmaking Technology Regulations, California Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Companion Chatbot Safety and Accountability Act (SB 243), California and 123 more, every one in the free file.
	AIR-DET-004AI System Observability	81	38	51 in force, 29 not yet in force, 1 proposed
	The 81 laws behind 4.1 and AIR-DET-004 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Employment Technological Displacement Notice (SB 951), California from 1 Jan 2027, in 2 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado and 71 more, every one in the free file.
	AIR-PREV-006Data Quality & Classification/Sensitivity	79	38	50 in force, 28 not yet in force, 1 proposed
	The 79 laws behind 4.1 and AIR-PREV-006 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 69 more, every one in the free file.
	AIR-PREV-005System Acceptance Testing	79	37	50 in force, 28 not yet in force, 1 proposed
	The 79 laws behind 4.1 and AIR-PREV-005 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Attorney, Court Filing and Arbitrator Generative AI Duties (SB 574), California from 1 Jan 2027, in 2 months Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado and 69 more, every one in the free file.
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 4.1 and AIR-PREV-024 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	AIR-DET-011Human Feedback Loop for AI Systems	78	37	50 in force, 27 not yet in force, 1 proposed
	The 78 laws behind 4.1 and AIR-DET-011 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	19	16	18 in force, 1 not yet in force
	The 19 laws behind 4.1 and AIR-PREV-007 Code de droit économique, article XI.190, 20°, exception de fouille de textes et de données, Belgium Law on Copyright and Related Rights, Content Limitations (No Text-and-Data-Mining Exception), Bosnia and Herzegovina Copyright and Neighbouring Rights Act (ZAPSP), Arts. 26e, 26zh and 26k, Text-and-Data-Mining Exception for Crawling and Training, Bulgaria Copyright (Cayman Islands) Order 2015, text and data analysis exception, Cayman Islands Copyright Act 2013, economic rights, computer program copying, and technological protection measures, Cook Islands Autorský zákon Sections 39c-39d, Text and Data Mining Exception for Automated Analysis, Czech Republic AI Act, Article 53 (obligations for providers of general-purpose AI models), European Union Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union DSM Directive, Article 4 (text-and-data-mining exception and rights reservation), European Union Copyright Act 1999, Fair Dealing and Criminal Liability for Infringement, Fiji from a date not yet set and 9 more, every one in the free file.
	AIR-PREV-018Agent Authority Least Privilege Framework	2	2	2 in force
	The 2 laws behind 4.1 and AIR-PREV-018 Copyright Act 2013, economic rights, computer program copying, and technological protection measures, Cook Islands Schutz technischer Massnahmen und Durchsetzung von Schrankenbestimmungen (Protection of Technological Measures), Germany
	AIR-PREV-023Agentic System Credential Protection Framework	2	2	2 in force
	The 2 laws behind 4.1 and AIR-PREV-023 Copyright Act 2013, economic rights, computer program copying, and technological protection measures, Cook Islands Schutz technischer Massnahmen und Durchsetzung von Schrankenbestimmungen (Protection of Technological Measures), Germany
4.2Risk Disclosure	AIR-DET-021Agent Decision Audit and Explainability	89	51	55 in force, 21 not yet in force, 13 proposed
	The 89 laws behind 4.2 and AIR-DET-021 Distribution of Materially Deceptive Media to Influence an Upcoming Election, Alabama SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Loi n° 09-04 relative à la prévention et à la lutte contre les infractions liées aux technologies de l'information et de la communication, Algeria Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Practice Direction No. 18 of 2025, ethical use of generative AI in court proceedings, Belize Attorney, Court Filing and Arbitrator Generative AI Duties (SB 574), California from 1 Jan 2027, in 2 months California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), California CCPA Automated Decisionmaking Technology Regulations, California Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months and 79 more, every one in the free file.
	AIR-DET-004AI System Observability	29	18	20 in force, 8 not yet in force, 1 proposed
	The 29 laws behind 4.2 and AIR-DET-004 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Loi n° 09-04 relative à la prévention et à la lutte contre les infractions liées aux technologies de l'information et de la communication, Algeria Companion Chatbot Safety and Accountability Act (SB 243), California Employment Technological Displacement Notice (SB 951), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months HB 26-1263 (2026), Conversational AI Service Operator Requirements, Colorado AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months AI Act, Article 20 (corrective actions and duty of information), European Union from 2 Dec 2027, in 13 months and 19 more, every one in the free file.
	AIR-PREV-005System Acceptance Testing	16	12	11 in force, 4 not yet in force, 1 proposed
	The 16 laws behind 4.2 and AIR-PREV-005 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Attorney, Court Filing and Arbitrator Generative AI Duties (SB 574), California from 1 Jan 2027, in 2 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary and 6 more, every one in the free file.
	AIR-PREV-006Data Quality & Classification/Sensitivity	16	12	11 in force, 4 not yet in force, 1 proposed
	The 16 laws behind 4.2 and AIR-PREV-006 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months Consumer Credit Act, Articles 24 and 30, Personalised Offers and Creditworthiness Assessment by Automated Processing, Croatia from 20 Nov 2026, in 4 weeks AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary and 6 more, every one in the free file.
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	15	11	11 in force, 3 not yet in force, 1 proposed
	The 15 laws behind 4.2 and AIR-PREV-024 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica and 5 more, every one in the free file.
	AIR-DET-011Human Feedback Loop for AI Systems	15	11	11 in force, 3 not yet in force, 1 proposed
	The 15 laws behind 4.2 and AIR-DET-011 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica and 5 more, every one in the free file.
4.3Incident Reporting	AIR-DET-004AI System Observability	27	16	19 in force, 7 not yet in force, 1 proposed
	The 27 laws behind 4.3 and AIR-DET-004 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Loi n° 09-04 relative à la prévention et à la lutte contre les infractions liées aux technologies de l'information et de la communication, Algeria Companion Chatbot Safety and Accountability Act (SB 243), California Employment Technological Displacement Notice (SB 951), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months HB 26-1263 (2026), Conversational AI Service Operator Requirements, Colorado AI Act, Article 20 (corrective actions and duty of information), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months and 17 more, every one in the free file.
	AIR-DET-021Agent Decision Audit and Explainability	26	16	18 in force, 7 not yet in force, 1 proposed
	The 26 laws behind 4.3 and AIR-DET-021 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Loi n° 09-04 relative à la prévention et à la lutte contre les infractions liées aux technologies de l'information et de la communication, Algeria Companion Chatbot Safety and Accountability Act (SB 243), California Employment Technological Displacement Notice (SB 951), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months HB 26-1263 (2026), Conversational AI Service Operator Requirements, Colorado AI Act, Article 20 (corrective actions and duty of information), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months and 16 more, every one in the free file.
	AIR-PREV-005System Acceptance Testing	12	9	9 in force, 2 not yet in force, 1 proposed
	The 12 laws behind 4.3 and AIR-PREV-005 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius and 2 more, every one in the free file.
	AIR-PREV-006Data Quality & Classification/Sensitivity	12	9	9 in force, 2 not yet in force, 1 proposed
	The 12 laws behind 4.3 and AIR-PREV-006 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius and 2 more, every one in the free file.
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	12	9	9 in force, 2 not yet in force, 1 proposed
	The 12 laws behind 4.3 and AIR-PREV-024 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius and 2 more, every one in the free file.
	AIR-DET-011Human Feedback Loop for AI Systems	12	9	9 in force, 2 not yet in force, 1 proposed
	The 12 laws behind 4.3 and AIR-DET-011 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius and 2 more, every one in the free file.
4.4Governance Disclosure	AIR-PREV-005System Acceptance Testing	3	3	2 in force, 1 not yet in force
	The 3 laws behind 4.4 and AIR-PREV-005 AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius Digital Transformation Act 2025, ICT service permit for AI and AI-related data services, Vanuatu
	AIR-PREV-006Data Quality & Classification/Sensitivity	3	3	2 in force, 1 not yet in force
	The 3 laws behind 4.4 and AIR-PREV-006 AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius Digital Transformation Act 2025, ICT service permit for AI and AI-related data services, Vanuatu
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	3	3	2 in force, 1 not yet in force
	The 3 laws behind 4.4 and AIR-PREV-024 AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius Digital Transformation Act 2025, ICT service permit for AI and AI-related data services, Vanuatu
	AIR-DET-004AI System Observability	3	3	2 in force, 1 not yet in force
	The 3 laws behind 4.4 and AIR-DET-004 AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius Digital Transformation Act 2025, ICT service permit for AI and AI-related data services, Vanuatu
	AIR-DET-011Human Feedback Loop for AI Systems	3	3	2 in force, 1 not yet in force
	The 3 laws behind 4.4 and AIR-DET-011 AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius Digital Transformation Act 2025, ICT service permit for AI and AI-related data services, Vanuatu
	AIR-DET-021Agent Decision Audit and Explainability	3	3	2 in force, 1 not yet in force
	The 3 laws behind 4.4 and AIR-DET-021 AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius Digital Transformation Act 2025, ICT service permit for AI and AI-related data services, Vanuatu
4.5Third-Party System Access	AIR-DET-004AI System Observability	26	16	18 in force, 7 not yet in force, 1 proposed
	The 26 laws behind 4.5 and AIR-DET-004 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Loi n° 09-04 relative à la prévention et à la lutte contre les infractions liées aux technologies de l'information et de la communication, Algeria Companion Chatbot Safety and Accountability Act (SB 243), California Employment Technological Displacement Notice (SB 951), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months HB 26-1263 (2026), Conversational AI Service Operator Requirements, Colorado AI Act, Article 20 (corrective actions and duty of information), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months and 16 more, every one in the free file.
	AIR-DET-021Agent Decision Audit and Explainability	26	16	18 in force, 7 not yet in force, 1 proposed
	The 26 laws behind 4.5 and AIR-DET-021 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Loi n° 09-04 relative à la prévention et à la lutte contre les infractions liées aux technologies de l'information et de la communication, Algeria Companion Chatbot Safety and Accountability Act (SB 243), California Employment Technological Displacement Notice (SB 951), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months HB 26-1263 (2026), Conversational AI Service Operator Requirements, Colorado AI Act, Article 20 (corrective actions and duty of information), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months and 16 more, every one in the free file.
	AIR-PREV-005System Acceptance Testing	12	9	9 in force, 2 not yet in force, 1 proposed
	The 12 laws behind 4.5 and AIR-PREV-005 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius and 2 more, every one in the free file.
	AIR-PREV-006Data Quality & Classification/Sensitivity	12	9	9 in force, 2 not yet in force, 1 proposed
	The 12 laws behind 4.5 and AIR-PREV-006 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius and 2 more, every one in the free file.
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	12	9	9 in force, 2 not yet in force, 1 proposed
	The 12 laws behind 4.5 and AIR-PREV-024 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius and 2 more, every one in the free file.
	AIR-DET-011Human Feedback Loop for AI Systems	12	9	9 in force, 2 not yet in force, 1 proposed
	The 12 laws behind 4.5 and AIR-DET-011 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius and 2 more, every one in the free file.
4.6User Rights & Recourse	AIR-DET-021Agent Decision Audit and Explainability	71	44	42 in force, 17 not yet in force, 12 proposed
	The 71 laws behind 4.6 and AIR-DET-021 Distribution of Materially Deceptive Media to Influence an Upcoming Election, Alabama SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Practice Direction No. 18 of 2025, ethical use of generative AI in court proceedings, Belize Attorney, Court Filing and Arbitrator Generative AI Duties (SB 574), California from 1 Jan 2027, in 2 months California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), California CCPA Automated Decisionmaking Technology Regulations, California Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Companion Chatbot Safety and Accountability Act (SB 243), California and 61 more, every one in the free file.
	AIR-DET-004AI System Observability	7	5	4 in force, 3 not yet in force
	The 7 laws behind 4.6 and AIR-DET-004 Employment Technological Displacement Notice (SB 951), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Artificial Intelligence Video Interview Act, Illinois Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months
	AIR-PREV-006Data Quality & Classification/Sensitivity	6	6	3 in force, 3 not yet in force
	The 6 laws behind 4.6 and AIR-PREV-006 CCPA Automated Decisionmaking Technology Regulations, California Consumer Credit Act, Articles 24 and 30, Personalised Offers and Creditworthiness Assessment by Automated Processing, Croatia from 20 Nov 2026, in 4 weeks AI Act, Article 86 (right to explanation of individual decision-making), European Union from 2 Dec 2027, in 13 months Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Consumer Credit Act (2026:1011), Chapter 2 Section 7 and Chapter 3 Section 15, Personalised Offers and Credit Assessment by Automated Processing, Sweden from 20 Nov 2026, in 4 weeks
	AIR-PREV-005System Acceptance Testing	3	3	2 in force, 1 not yet in force
	The 3 laws behind 4.6 and AIR-PREV-005 Attorney, Court Filing and Arbitrator Generative AI Duties (SB 574), California from 1 Jan 2027, in 2 months Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	2	2	2 in force
	The 2 laws behind 4.6 and AIR-PREV-024 Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
	AIR-DET-011Human Feedback Loop for AI Systems	2	2	2 in force
	The 2 laws behind 4.6 and AIR-DET-011 Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan

Not connected to the FINOS AIGF: 5 of MIT mitigations' controls

No law we track reaches these

No duty in the laws we track reaches these controls.

1.3 Conflict of Interest Protections
1.4 Whistleblower Reporting & Protection
1.6 Environmental Impact Management
2.2 Model Alignment
3.4 Staged Deployment

How these connections are drawn

Each requirement line in the laws we track is read against the framework for its subject (the AI, scraping and news aggregation laws against the NIST AI RMF, the privacy, communications and age assurance laws against the NIST Privacy Framework, the cybersecurity laws against the NIST CSF 2.0); laws on liability and content moderation are not read against any framework yet. A line reaches either framework through a kind of duty its law carries, and only where that kind of duty also reaches, on that same line, the NIST framework for the line's own subject. Two controls connect when lines in at least 2 laws reach both. That says the same duties reach both; it does not say the two are alike, or that running either one does what a law asks.

Every duty line in the AI, scraping and news aggregation laws we track has been read against the framework for its subject.

Sources and licenses

MIT AI Risk Initiative (MIT FutureTech), AI Risk Mitigation Taxonomy. Data from the MIT AI Risk Initiative is licensed under CC BY 4.0. Cite as: Mapping AI Risk Mitigations: Evidence Scan & Draft Mitigation Taxonomy