Law / Frameworks / Crosswalk / MIT mitigations to NIST AI RMF

The MIT AI Risk Mitigation Taxonomy, mapped to the NIST AI Risk Management Framework

18 of MIT mitigations' controls connect to 28 of NIST AI RMF's through 481 laws in 171 jurisdictions. Two controls connect when the same duties, in at least 2 laws we track, reach both. The connections are our own reading of the law; no framework publisher has reviewed or endorsed them.

From: MIT AI Risk Mitigation Taxonomy, preliminary taxonomy, July 2025, MIT AI Risk Initiative
To: NIST AI Risk Management Framework, version 1.0, January 2023 (NIST AI 100-1), National Institute of Standards and Technology
See also: NIST AI RMF to MIT mitigations, the other way · every pair in the crosswalk · law library as of 19 Oct 2026

Download this mapping, with every law behind each connection: nist-ai-rmf--mit-ai-risk-mitigations.csv · nist-ai-rmf--mit-ai-risk-mitigations.json

MIT mitigations	NIST AI RMF	Laws	Jurisdictions	Where the laws stand
1.1Board Structure & Oversight	GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.	38	20	28 in force, 9 not yet in force, 1 proposed
	The 38 laws behind 1.1 and GOVERN 1.1 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months Lov nr. 467 af 14. maj 2025, National Competent Authorities and Article 5 Enforcement, Denmark Resolución ANIA 0001/2025, registro obligatorio para decisiones consecuenciales, El Salvador AI Act, Article 111(2) (2030 compliance deadline for public-authority-intended systems), European Union from 2 Aug 2030, in 3.8 years AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months AI Act, Article 18 (documentation keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 21(2) (competent authority access to automatically generated logs), European Union from 2 Dec 2027, in 13 months AI Act, Article 22(3), points (b) and (c) (authorised representative: documents held for 10 years and access to logs), European Union from 2 Dec 2027, in 13 months and 28 more, every one in the free file.
	MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with...	25	18	17 in force, 8 not yet in force
	The 25 laws behind 1.1 and MAP 3.5 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Private Review Agent Artificial Intelligence Coverage Determinations Act (SB 444), Georgia from 1 Jan 2027, in 2 months and 15 more, every one in the free file.
	MEASURE 2.4The functionality and behavior of the AI system and its components – as identified in...	22	11	12 in force, 10 not yet in force
	The 22 laws behind 1.1 and MEASURE 2.4 Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 12 (record-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 19 (automatically generated logs), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(6) (deployer log-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months AI Act, Article 72 (post-market monitoring by providers and post-market monitoring plan), European Union from 2 Dec 2027, in 13 months and 12 more, every one in the free file.
	GOVERN 1.4The risk management process and its outcomes are established through transparent...	17	12	11 in force, 6 not yet in force
	The 17 laws behind 1.1 and GOVERN 1.4 Transparency in Frontier Artificial Intelligence Act (SB 53), California OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado AI Act, Article 17 (quality management system), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months AI Act, Article 9 (risk management system), European Union from 2 Dec 2027, in 13 months EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan and 7 more, every one in the free file.
	MAP 2.3Scientific integrity and TEVV considerations are identified and documented, including...	12	9	8 in force, 4 not yet in force
	The 12 laws behind 1.1 and MAP 2.3 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months AI Act, Article 53 (obligations for providers of general-purpose AI models), European Union Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Counter-Fraud Framework: fraud detection systems, machine learning and artificial intelligence, Saudi Arabia Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom and 2 more, every one in the free file.
	GOVERN 1.6Mechanisms are in place to inventory AI systems and are resourced according to...	7	6	6 in force, 1 not yet in force
	The 7 laws behind 1.1 and GOVERN 1.6 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom Interagency Supervisory Guidance on Model Risk Management (2026 revision), United States
	GOVERN 2.1Roles and responsibilities and lines of communication related to mapping, measuring,...	7	6	7 in force
	The 7 laws behind 1.1 and GOVERN 2.1 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union MiFID II Suitability Assessment for Investment Advice and Portfolio Management, Including Automated and Semi-Automated Systems (Article 25(2) and Delegated Regulation 2017/565 Article 54), European Union Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Suitability for MiFID business: personal recommendations and decisions to trade, including advice given through an automated or semi-automated system, United Kingdom Interagency Supervisory Guidance on Model Risk Management (2026 revision), United States
	MEASURE 2.11Fairness and bias – as identified in the MAP function – are evaluated and results are...	6	5	4 in force, 2 not yet in force
	The 6 laws behind 1.1 and MEASURE 2.11 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
	GOVERN 2.3Executive leadership of the organization takes responsibility for decisions about...	4	4	4 in force
	The 4 laws behind 1.1 and GOVERN 2.3 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
	MEASURE 2.9The AI model is explained, validated, and documented, and AI system output is...	4	4	4 in force
	The 4 laws behind 1.1 and MEASURE 2.9 Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom
	MANAGE 2.4Mechanisms are in place and applied, and responsibilities are assigned and understood,...	4	3	4 in force
	The 4 laws behind 1.1 and MANAGE 2.4 Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model Management Standards: governance, validation and monitoring of the models a bank uses to decide, including artificial intelligence models, United Arab Emirates
	MAP 5.1Likelihood and magnitude of each identified impact (both potentially beneficial and...	3	3	3 in force
	The 3 laws behind 1.1 and MAP 5.1 Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
	MAP 3.3Targeted application scope is specified and documented based on the system’s...	3	2	3 in force
	The 3 laws behind 1.1 and MAP 3.3 Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Law on Artificial Intelligence, risk classification and conformity assessment, Vietnam
	MEASURE 2.7AI system security and resilience – as identified in the MAP function – are evaluated...	2	2	1 in force, 1 not yet in force
	The 2 laws behind 1.1 and MEASURE 2.7 Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Federal Law No. 243-FZ, Article 8, Duties of Sovereign and National Foundation Model Developers, Russia from 1 Mar 2027, in 4 months
	MEASURE 3.3Feedback processes for end users and impacted communities to report problems and...	2	2	2 in force
	The 2 laws behind 1.1 and MEASURE 3.3 FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
1.2Risk Management	GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.	38	20	28 in force, 9 not yet in force, 1 proposed
	The 38 laws behind 1.2 and GOVERN 1.1 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months Lov nr. 467 af 14. maj 2025, National Competent Authorities and Article 5 Enforcement, Denmark Resolución ANIA 0001/2025, registro obligatorio para decisiones consecuenciales, El Salvador AI Act, Article 111(2) (2030 compliance deadline for public-authority-intended systems), European Union from 2 Aug 2030, in 3.8 years AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months AI Act, Article 18 (documentation keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 21(2) (competent authority access to automatically generated logs), European Union from 2 Dec 2027, in 13 months AI Act, Article 22(3), points (b) and (c) (authorised representative: documents held for 10 years and access to logs), European Union from 2 Dec 2027, in 13 months and 28 more, every one in the free file.
	MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with...	25	18	17 in force, 8 not yet in force
	The 25 laws behind 1.2 and MAP 3.5 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Private Review Agent Artificial Intelligence Coverage Determinations Act (SB 444), Georgia from 1 Jan 2027, in 2 months and 15 more, every one in the free file.
	MEASURE 2.4The functionality and behavior of the AI system and its components – as identified in...	22	11	12 in force, 10 not yet in force
	The 22 laws behind 1.2 and MEASURE 2.4 Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 12 (record-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 19 (automatically generated logs), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(6) (deployer log-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months AI Act, Article 72 (post-market monitoring by providers and post-market monitoring plan), European Union from 2 Dec 2027, in 13 months and 12 more, every one in the free file.
	GOVERN 1.4The risk management process and its outcomes are established through transparent...	17	12	11 in force, 6 not yet in force
	The 17 laws behind 1.2 and GOVERN 1.4 Transparency in Frontier Artificial Intelligence Act (SB 53), California OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado AI Act, Article 17 (quality management system), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months AI Act, Article 9 (risk management system), European Union from 2 Dec 2027, in 13 months EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan and 7 more, every one in the free file.
	MAP 2.3Scientific integrity and TEVV considerations are identified and documented, including...	12	9	8 in force, 4 not yet in force
	The 12 laws behind 1.2 and MAP 2.3 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months AI Act, Article 53 (obligations for providers of general-purpose AI models), European Union Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Counter-Fraud Framework: fraud detection systems, machine learning and artificial intelligence, Saudi Arabia Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom and 2 more, every one in the free file.
	MAP 5.1Likelihood and magnitude of each identified impact (both potentially beneficial and...	11	10	5 in force, 1 not yet in force, 5 proposed
	The 11 laws behind 1.2 and MAP 5.1 Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Canada, Canada proposed AI Act, Article 27 (fundamental rights impact assessment), European Union from 2 Dec 2027, in 13 months Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan Council of Europe Framework Convention on Artificial Intelligence, signed by Moldova, Moldova proposed and 1 more, every one in the free file.
	GOVERN 1.6Mechanisms are in place to inventory AI systems and are resourced according to...	7	6	6 in force, 1 not yet in force
	The 7 laws behind 1.2 and GOVERN 1.6 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom Interagency Supervisory Guidance on Model Risk Management (2026 revision), United States
	GOVERN 2.1Roles and responsibilities and lines of communication related to mapping, measuring,...	7	6	7 in force
	The 7 laws behind 1.2 and GOVERN 2.1 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union MiFID II Suitability Assessment for Investment Advice and Portfolio Management, Including Automated and Semi-Automated Systems (Article 25(2) and Delegated Regulation 2017/565 Article 54), European Union Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Suitability for MiFID business: personal recommendations and decisions to trade, including advice given through an automated or semi-automated system, United Kingdom Interagency Supervisory Guidance on Model Risk Management (2026 revision), United States
	MANAGE 1.3Responses to the AI risks deemed high priority, as identified by the MAP function, are...	6	6	1 not yet in force, 5 proposed
	The 6 laws behind 1.2 and MANAGE 1.3 Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Council of Europe Framework Convention on Artificial Intelligence, signed by Canada, Canada proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Moldova, Moldova proposed Council of Europe Framework Convention on Artificial Intelligence, signed by the United Kingdom, United Kingdom proposed
	MEASURE 2.11Fairness and bias – as identified in the MAP function – are evaluated and results are...	6	5	4 in force, 2 not yet in force
	The 6 laws behind 1.2 and MEASURE 2.11 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
	MEASURE 2.10Privacy risk of the AI system – as identified in the MAP function – is examined and documented.	5	5	3 in force, 2 not yet in force
	The 5 laws behind 1.2 and MEASURE 2.10 HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months Ley de Fomento a la Inteligencia Artificial y Tecnologías, marco institucional, registro y evaluación de riesgos, El Salvador AI Act, Article 26(9) (using Article 13 information for a data protection impact assessment), European Union from 2 Dec 2027, in 13 months Act XLVII of 1997 on Health Data, Section 35/A(4) to (8), Conditions for AI Development on Electronic Health Service Space Data, Hungary FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius
	GOVERN 2.3Executive leadership of the organization takes responsibility for decisions about...	4	4	4 in force
	The 4 laws behind 1.2 and GOVERN 2.3 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
	MEASURE 2.9The AI model is explained, validated, and documented, and AI system output is...	4	4	4 in force
	The 4 laws behind 1.2 and MEASURE 2.9 Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom
	MANAGE 2.4Mechanisms are in place and applied, and responsibilities are assigned and understood,...	4	3	4 in force
	The 4 laws behind 1.2 and MANAGE 2.4 Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model Management Standards: governance, validation and monitoring of the models a bank uses to decide, including artificial intelligence models, United Arab Emirates
	MAP 3.3Targeted application scope is specified and documented based on the system’s...	3	2	3 in force
	The 3 laws behind 1.2 and MAP 3.3 Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Law on Artificial Intelligence, risk classification and conformity assessment, Vietnam
	GOVERN 4.2Organizational teams document the risks and potential impacts of the AI technology...	2	2	2 in force
	The 2 laws behind 1.2 and GOVERN 4.2 Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan
	MEASURE 2.7AI system security and resilience – as identified in the MAP function – are evaluated...	2	2	1 in force, 1 not yet in force
	The 2 laws behind 1.2 and MEASURE 2.7 Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Federal Law No. 243-FZ, Article 8, Duties of Sovereign and National Foundation Model Developers, Russia from 1 Mar 2027, in 4 months
	MEASURE 3.3Feedback processes for end users and impacted communities to report problems and...	2	2	2 in force
	The 2 laws behind 1.2 and MEASURE 3.3 FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
1.5Safety Decision Frameworks	MAP 3.3Targeted application scope is specified and documented based on the system’s...	143	86	124 in force, 15 not yet in force, 1 blocked by a court, 3 proposed
1.5Safety Decision Frameworks	The 143 laws behind 1.5 and MAP 3.3 Alabama Child Protection Act of 2024, AI-Generated Child Sexual Abuse Material, Alabama AI-generated and indistinguishable depictions included in child-exploitation definitions (HB 2678), Arizona Unlawful disclosure extended to AI-generated 'realistic pictorial representation' intimate images (SB 1462), Arizona Act 159 of 2025 (HB 1071), AI-Generated Replicas Amendment to Publicity Rights Act, Arkansas Act 827 of 2025 (HB 1529), Unlawful Creation or Distribution of Deepfake Visual Material, Arkansas Act 977 of 2025 (HB 1877), AI-Generated Child Sexual Abuse Material Amendments, Arkansas Using a Carriage Service to Transmit Sexual Material Without Consent (Deepfake Offences), Australia StGB Section 207a(4)(4), Computer-Generated and Altered Child Sexual Abuse Material, Austria Sexual Offences Act, child pornography offence, Bahamas Cyber Security Act, 2026, AI-generated sexual content and CSAM ban, Bangladesh and 133 more, every one in the free file.
1.7Societal Impact Assessment	MAP 5.1Likelihood and magnitude of each identified impact (both potentially beneficial and...	9	8	3 in force, 1 not yet in force, 5 proposed
	The 9 laws behind 1.7 and MAP 5.1 Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Canada, Canada proposed AI Act, Article 27 (fundamental rights impact assessment), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan Council of Europe Framework Convention on Artificial Intelligence, signed by Moldova, Moldova proposed Council of Europe Framework Convention on Artificial Intelligence, signed by the United Kingdom, United Kingdom proposed
	MANAGE 1.3Responses to the AI risks deemed high priority, as identified by the MAP function, are...	5	5	5 proposed
	The 5 laws behind 1.7 and MANAGE 1.3 Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Canada, Canada proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Moldova, Moldova proposed Council of Europe Framework Convention on Artificial Intelligence, signed by the United Kingdom, United Kingdom proposed
	MEASURE 2.10Privacy risk of the AI system – as identified in the MAP function – is examined and documented.	4	4	3 in force, 1 not yet in force
	The 4 laws behind 1.7 and MEASURE 2.10 Ley de Fomento a la Inteligencia Artificial y Tecnologías, marco institucional, registro y evaluación de riesgos, El Salvador AI Act, Article 26(9) (using Article 13 information for a data protection impact assessment), European Union from 2 Dec 2027, in 13 months Act XLVII of 1997 on Health Data, Section 35/A(4) to (8), Conditions for AI Development on Electronic Health Service Space Data, Hungary FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius
2.1Model & Infrastructure Security	MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the...	145	107	142 in force, 3 not yet in force
	The 145 laws behind 2.1 and MAP 4.1 Penal Code, Part Twelve, Chapter One (Cyber Crimes and Punishment), Afghanistan Alabama Digital Crime Act, Computer Tampering, Alabama Criminal mischief in the fourth degree, unauthorized computer access, Alaska Criminal use of a computer, Alaska Theft of services, unauthorized use of a computer system, Alaska Copyright Law, Sui Generis Database Producers Rights, Albania Criminal Code, Unauthorized Computer Access, Albania Code pénal, atteintes aux systèmes de traitement automatisé de données, Algeria Ordonnance n° 03-05, exception de citation, Algeria Ordonnance n° 03-05, protection des bases de données, Algeria and 135 more, every one in the free file.
	MEASURE 2.6The AI system is evaluated regularly for safety risks – as identified in the MAP...	3	2	2 in force, 1 not yet in force
	The 3 laws behind 2.1 and MEASURE 2.6 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	MEASURE 2.5The AI system to be deployed is demonstrated to be valid and reliable. Limitations of...	2	1	1 in force, 1 not yet in force
	The 2 laws behind 2.1 and MEASURE 2.5 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
	MEASURE 2.7AI system security and resilience – as identified in the MAP function – are evaluated...	2	1	1 in force, 1 not yet in force
	The 2 laws behind 2.1 and MEASURE 2.7 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
2.3Model Safety Engineering	MEASURE 2.6The AI system is evaluated regularly for safety risks – as identified in the MAP...	7	6	3 in force, 4 not yet in force
	The 7 laws behind 2.3 and MEASURE 2.6 HB 26-1263 (2026), Conversational AI Service Operator Requirements, Colorado AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Conversational AI Safety Act, Idaho from 1 Jul 2027, in 8 months Conversational AI Services Act (Senate File 2417), Iowa from 1 Jul 2027, in 8 months Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months
	MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are...	4	4	1 in force, 3 not yet in force
	The 4 laws behind 2.3 and MAP 1.6 HB 26-1263 (2026), Conversational AI Service Operator Requirements, Colorado Conversational AI Safety Act, Idaho from 1 Jul 2027, in 8 months Conversational AI Services Act (Senate File 2417), Iowa from 1 Jul 2027, in 8 months AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months
	MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP...	3	3	1 in force, 2 not yet in force
	The 3 laws behind 2.3 and MEASURE 2.8 HB 26-1263 (2026), Conversational AI Service Operator Requirements, Colorado Conversational AI Safety Act, Idaho from 1 Jul 2027, in 8 months AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months
	MAP 3.3Targeted application scope is specified and documented based on the system’s...	2	2	1 in force, 1 not yet in force
	The 2 laws behind 2.3 and MAP 3.3 MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Conversational AI Safety Act, Idaho from 1 Jul 2027, in 8 months
	MEASURE 2.5The AI system to be deployed is demonstrated to be valid and reliable. Limitations of...	2	1	1 in force, 1 not yet in force
	The 2 laws behind 2.3 and MEASURE 2.5 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
	MEASURE 2.7AI system security and resilience – as identified in the MAP function – are evaluated...	2	1	1 in force, 1 not yet in force
	The 2 laws behind 2.3 and MEASURE 2.7 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
2.4Content Safety Controls	MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP...	43	33	30 in force, 8 not yet in force, 1 blocked by a court, 4 proposed
	The 43 laws behind 2.4 and MEASURE 2.8 Distribution of Materially Deceptive Media to Influence an Upcoming Election, Alabama TSE Resolution, AI-Generated Content Disclosure Duty, Brazil AB 2839, election materially deceptive deepfake disclaimer law, California blocked by a court AB 730, as extended by AB 972, election deepfake disclosure law, California California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), California Synthetic Performer Advertising Disclosure Act (SB 1050), California from 1 Jan 2027, in 2 months HB 26-1263 (2026), Conversational AI Service Operator Requirements, Colorado Act Implementing the European Media Freedom Act, Article 23, Labelling of AI-Generated Content, Croatia AI Act, Article 50 (transparency obligations for AI systems and synthetic content), European Union Digital Services Act, Article 35(1)(k) (systemic risk mitigation, synthetic media marking), European Union and 33 more, every one in the free file.
	MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are...	4	4	1 in force, 3 not yet in force
	The 4 laws behind 2.4 and MAP 1.6 HB 26-1263 (2026), Conversational AI Service Operator Requirements, Colorado Conversational AI Safety Act, Idaho from 1 Jul 2027, in 8 months Conversational AI Services Act (Senate File 2417), Iowa from 1 Jul 2027, in 8 months AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months
	MEASURE 2.6The AI system is evaluated regularly for safety risks – as identified in the MAP...	4	4	1 in force, 3 not yet in force
	The 4 laws behind 2.4 and MEASURE 2.6 HB 26-1263 (2026), Conversational AI Service Operator Requirements, Colorado Conversational AI Safety Act, Idaho from 1 Jul 2027, in 8 months Conversational AI Services Act (Senate File 2417), Iowa from 1 Jul 2027, in 8 months AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months
3.1Testing & Auditing	MAP 5.1Likelihood and magnitude of each identified impact (both potentially beneficial and...	9	8	3 in force, 1 not yet in force, 5 proposed
	The 9 laws behind 3.1 and MAP 5.1 Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Canada, Canada proposed AI Act, Article 27 (fundamental rights impact assessment), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan Council of Europe Framework Convention on Artificial Intelligence, signed by Moldova, Moldova proposed Council of Europe Framework Convention on Artificial Intelligence, signed by the United Kingdom, United Kingdom proposed
	MANAGE 1.3Responses to the AI risks deemed high priority, as identified by the MAP function, are...	5	5	5 proposed
	The 5 laws behind 3.1 and MANAGE 1.3 Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Canada, Canada proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Moldova, Moldova proposed Council of Europe Framework Convention on Artificial Intelligence, signed by the United Kingdom, United Kingdom proposed
	MEASURE 2.10Privacy risk of the AI system – as identified in the MAP function – is examined and documented.	4	4	3 in force, 1 not yet in force
	The 4 laws behind 3.1 and MEASURE 2.10 Ley de Fomento a la Inteligencia Artificial y Tecnologías, marco institucional, registro y evaluación de riesgos, El Salvador AI Act, Article 26(9) (using Article 13 information for a data protection impact assessment), European Union from 2 Dec 2027, in 13 months Act XLVII of 1997 on Health Data, Section 35/A(4) to (8), Conditions for AI Development on Electronic Health Service Space Data, Hungary FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius
	MEASURE 2.6The AI system is evaluated regularly for safety risks – as identified in the MAP...	3	2	2 in force, 1 not yet in force
	The 3 laws behind 3.1 and MEASURE 2.6 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	MEASURE 2.5The AI system to be deployed is demonstrated to be valid and reliable. Limitations of...	2	1	1 in force, 1 not yet in force
	The 2 laws behind 3.1 and MEASURE 2.5 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
	MEASURE 2.7AI system security and resilience – as identified in the MAP function – are evaluated...	2	1	1 in force, 1 not yet in force
	The 2 laws behind 3.1 and MEASURE 2.7 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
3.2Data Governance	MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the...	189	119	185 in force, 4 not yet in force
	The 189 laws behind 3.2 and MAP 4.1 Penal Code, Part Twelve, Chapter One (Cyber Crimes and Punishment), Afghanistan Alabama Digital Crime Act, Computer Tampering, Alabama Criminal mischief in the fourth degree, unauthorized computer access, Alaska Criminal use of a computer, Alaska Theft of services, unauthorized use of a computer system, Alaska Copyright Law, Sui Generis Database Producers Rights, Albania Criminal Code, Unauthorized Computer Access, Albania Code pénal, atteintes aux systèmes de traitement automatisé de données, Algeria Ordonnance n° 03-05, exception de citation, Algeria Ordonnance n° 03-05, protection des bases de données, Algeria and 179 more, every one in the free file.
	MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are...	6	5	5 in force, 1 not yet in force
	The 6 laws behind 3.2 and MAP 1.6 Loi n° 24.001 portant protection des données à caractère personnel, collecte de données publiquement accessibles et transfert transfrontalier, Central African Republic HB 26-1195 (2026), Psychotherapy Artificial Intelligence Restrictions, Colorado Artificial Intelligence Video Interview Act, Illinois Wellness and Oversight for Psychological Resources Act, Illinois Use of artificial intelligence in therapy or psychotherapy services, Maine Digital Voyeurism Prevention Act (HB 276, 2026 General Session), Utah Code Title 13 Chapter 72b, Utah from 1 Jan 2027, in 2 months
	MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with...	5	3	3 in force, 2 not yet in force
	The 5 laws behind 3.2 and MAP 3.5 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Use of artificial intelligence in therapy or psychotherapy services, Maine
	MEASURE 2.9The AI model is explained, validated, and documented, and AI system output is...	4	4	1 in force, 3 not yet in force
	The 4 laws behind 3.2 and MEASURE 2.9 CCPA Automated Decisionmaking Technology Regulations, California Consumer Credit Act, Articles 24 and 30, Personalised Offers and Creditworthiness Assessment by Automated Processing, Croatia from 20 Nov 2026, in 4 weeks AI Act, Article 86 (right to explanation of individual decision-making), European Union from 2 Dec 2027, in 13 months Consumer Credit Act (2026:1011), Chapter 2 Section 7 and Chapter 3 Section 15, Personalised Offers and Credit Assessment by Automated Processing, Sweden from 20 Nov 2026, in 4 weeks
	MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP...	2	2	1 in force, 1 not yet in force
	The 2 laws behind 3.2 and MEASURE 2.8 Consumer Credit Act, Articles 24 and 30, Personalised Offers and Creditworthiness Assessment by Automated Processing, Croatia from 20 Nov 2026, in 4 weeks Artificial Intelligence Video Interview Act, Illinois
	MEASURE 2.10Privacy risk of the AI system – as identified in the MAP function – is examined and documented.	2	2	2 in force
	The 2 laws behind 3.2 and MEASURE 2.10 Loi n° 24.001 portant protection des données à caractère personnel, collecte de données publiquement accessibles et transfert transfrontalier, Central African Republic Artificial Intelligence Video Interview Act, Illinois
	MEASURE 3.3Feedback processes for end users and impacted communities to report problems and...	2	2	2 not yet in force
	The 2 laws behind 3.2 and MEASURE 3.3 Consumer Credit Act, Articles 24 and 30, Personalised Offers and Creditworthiness Assessment by Automated Processing, Croatia from 20 Nov 2026, in 4 weeks Consumer Credit Act (2026:1011), Chapter 2 Section 7 and Chapter 3 Section 15, Personalised Offers and Credit Assessment by Automated Processing, Sweden from 20 Nov 2026, in 4 weeks
	MAP 3.3Targeted application scope is specified and documented based on the system’s...	2	1	2 in force
	The 2 laws behind 3.2 and MAP 3.3 Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy
3.3Access Management	MAP 3.3Targeted application scope is specified and documented based on the system’s...	145	87	126 in force, 15 not yet in force, 1 blocked by a court, 3 proposed
	The 145 laws behind 3.3 and MAP 3.3 Alabama Child Protection Act of 2024, AI-Generated Child Sexual Abuse Material, Alabama AI-generated and indistinguishable depictions included in child-exploitation definitions (HB 2678), Arizona Unlawful disclosure extended to AI-generated 'realistic pictorial representation' intimate images (SB 1462), Arizona Act 159 of 2025 (HB 1071), AI-Generated Replicas Amendment to Publicity Rights Act, Arkansas Act 827 of 2025 (HB 1529), Unlawful Creation or Distribution of Deepfake Visual Material, Arkansas Act 977 of 2025 (HB 1877), AI-Generated Child Sexual Abuse Material Amendments, Arkansas Using a Carriage Service to Transmit Sexual Material Without Consent (Deepfake Offences), Australia StGB Section 207a(4)(4), Computer-Generated and Altered Child Sexual Abuse Material, Austria Sexual Offences Act, child pornography offence, Bahamas Cyber Security Act, 2026, AI-generated sexual content and CSAM ban, Bangladesh and 135 more, every one in the free file.
	MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with...	4	2	2 in force, 2 not yet in force
	The 4 laws behind 3.3 and MAP 3.5 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy
	GOVERN 6.1Policies and procedures are in place that address AI risks associated with third-party...	2	2	1 in force, 1 not yet in force
	The 2 laws behind 3.3 and GOVERN 6.1 AI Act, Article 25 (responsibilities along the AI value chain), European Union from 2 Dec 2027, in 13 months Reform to the Federal Labor Law and the Federal Copyright Law, AI Voice and Image Consent Regime for Performing Artists, Mexico
3.5Post-deployment Monitoring	GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.	38	20	28 in force, 9 not yet in force, 1 proposed
	The 38 laws behind 3.5 and GOVERN 1.1 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months Lov nr. 467 af 14. maj 2025, National Competent Authorities and Article 5 Enforcement, Denmark Resolución ANIA 0001/2025, registro obligatorio para decisiones consecuenciales, El Salvador AI Act, Article 111(2) (2030 compliance deadline for public-authority-intended systems), European Union from 2 Aug 2030, in 3.8 years AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months AI Act, Article 18 (documentation keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 21(2) (competent authority access to automatically generated logs), European Union from 2 Dec 2027, in 13 months AI Act, Article 22(3), points (b) and (c) (authorised representative: documents held for 10 years and access to logs), European Union from 2 Dec 2027, in 13 months and 28 more, every one in the free file.
	MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with...	25	18	17 in force, 8 not yet in force
	The 25 laws behind 3.5 and MAP 3.5 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Private Review Agent Artificial Intelligence Coverage Determinations Act (SB 444), Georgia from 1 Jan 2027, in 2 months and 15 more, every one in the free file.
	MEASURE 2.4The functionality and behavior of the AI system and its components – as identified in...	22	11	12 in force, 10 not yet in force
	The 22 laws behind 3.5 and MEASURE 2.4 Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 12 (record-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 19 (automatically generated logs), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(6) (deployer log-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months AI Act, Article 72 (post-market monitoring by providers and post-market monitoring plan), European Union from 2 Dec 2027, in 13 months and 12 more, every one in the free file.
	GOVERN 1.4The risk management process and its outcomes are established through transparent...	17	12	11 in force, 6 not yet in force
	The 17 laws behind 3.5 and GOVERN 1.4 Transparency in Frontier Artificial Intelligence Act (SB 53), California OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado AI Act, Article 17 (quality management system), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months AI Act, Article 9 (risk management system), European Union from 2 Dec 2027, in 13 months EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan and 7 more, every one in the free file.
	MAP 2.3Scientific integrity and TEVV considerations are identified and documented, including...	12	9	8 in force, 4 not yet in force
	The 12 laws behind 3.5 and MAP 2.3 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months AI Act, Article 53 (obligations for providers of general-purpose AI models), European Union Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Counter-Fraud Framework: fraud detection systems, machine learning and artificial intelligence, Saudi Arabia Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom and 2 more, every one in the free file.
	GOVERN 1.6Mechanisms are in place to inventory AI systems and are resourced according to...	7	6	6 in force, 1 not yet in force
	The 7 laws behind 3.5 and GOVERN 1.6 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom Interagency Supervisory Guidance on Model Risk Management (2026 revision), United States
	GOVERN 2.1Roles and responsibilities and lines of communication related to mapping, measuring,...	7	6	7 in force
	The 7 laws behind 3.5 and GOVERN 2.1 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union MiFID II Suitability Assessment for Investment Advice and Portfolio Management, Including Automated and Semi-Automated Systems (Article 25(2) and Delegated Regulation 2017/565 Article 54), European Union Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Suitability for MiFID business: personal recommendations and decisions to trade, including advice given through an automated or semi-automated system, United Kingdom Interagency Supervisory Guidance on Model Risk Management (2026 revision), United States
	MEASURE 2.11Fairness and bias – as identified in the MAP function – are evaluated and results are...	6	5	4 in force, 2 not yet in force
	The 6 laws behind 3.5 and MEASURE 2.11 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
	GOVERN 2.3Executive leadership of the organization takes responsibility for decisions about...	4	4	4 in force
	The 4 laws behind 3.5 and GOVERN 2.3 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
	MEASURE 2.9The AI model is explained, validated, and documented, and AI system output is...	4	4	4 in force
	The 4 laws behind 3.5 and MEASURE 2.9 Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom
	MANAGE 2.4Mechanisms are in place and applied, and responsibilities are assigned and understood,...	4	3	4 in force
	The 4 laws behind 3.5 and MANAGE 2.4 Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model Management Standards: governance, validation and monitoring of the models a bank uses to decide, including artificial intelligence models, United Arab Emirates
	MAP 5.1Likelihood and magnitude of each identified impact (both potentially beneficial and...	3	3	3 in force
	The 3 laws behind 3.5 and MAP 5.1 Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
	MAP 3.3Targeted application scope is specified and documented based on the system’s...	3	2	3 in force
	The 3 laws behind 3.5 and MAP 3.3 Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Law on Artificial Intelligence, risk classification and conformity assessment, Vietnam
	MEASURE 2.7AI system security and resilience – as identified in the MAP function – are evaluated...	2	2	1 in force, 1 not yet in force
	The 2 laws behind 3.5 and MEASURE 2.7 Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Federal Law No. 243-FZ, Article 8, Duties of Sovereign and National Foundation Model Developers, Russia from 1 Mar 2027, in 4 months
	MEASURE 3.3Feedback processes for end users and impacted communities to report problems and...	2	2	2 in force
	The 2 laws behind 3.5 and MEASURE 3.3 FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
3.6Incident Response & Recovery	MEASURE 2.6The AI system is evaluated regularly for safety risks – as identified in the MAP...	3	2	2 in force, 1 not yet in force
	The 3 laws behind 3.6 and MEASURE 2.6 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	MEASURE 2.5The AI system to be deployed is demonstrated to be valid and reliable. Limitations of...	2	1	1 in force, 1 not yet in force
	The 2 laws behind 3.6 and MEASURE 2.5 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
	MEASURE 2.7AI system security and resilience – as identified in the MAP function – are evaluated...	2	1	1 in force, 1 not yet in force
	The 2 laws behind 3.6 and MEASURE 2.7 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
4.1System Documentation	MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP...	64	43	40 in force, 12 not yet in force, 12 proposed
	The 64 laws behind 4.1 and MEASURE 2.8 Distribution of Materially Deceptive Media to Influence an Upcoming Election, Alabama SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Practice Direction No. 18 of 2025, ethical use of generative AI in court proceedings, Belize Attorney, Court Filing and Arbitrator Generative AI Duties (SB 574), California from 1 Jan 2027, in 2 months California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), California CCPA Automated Decisionmaking Technology Regulations, California Companion Chatbot Safety and Accountability Act (SB 243), California Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months and 54 more, every one in the free file.
	GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.	38	20	28 in force, 9 not yet in force, 1 proposed
	The 38 laws behind 4.1 and GOVERN 1.1 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months Lov nr. 467 af 14. maj 2025, National Competent Authorities and Article 5 Enforcement, Denmark Resolución ANIA 0001/2025, registro obligatorio para decisiones consecuenciales, El Salvador AI Act, Article 111(2) (2030 compliance deadline for public-authority-intended systems), European Union from 2 Aug 2030, in 3.8 years AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months AI Act, Article 18 (documentation keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 21(2) (competent authority access to automatically generated logs), European Union from 2 Dec 2027, in 13 months AI Act, Article 22(3), points (b) and (c) (authorised representative: documents held for 10 years and access to logs), European Union from 2 Dec 2027, in 13 months and 28 more, every one in the free file.
	MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with...	26	19	18 in force, 8 not yet in force
	The 26 laws behind 4.1 and MAP 3.5 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Practice Direction No. 18 of 2025, ethical use of generative AI in court proceedings, Belize Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union and 16 more, every one in the free file.
	MEASURE 2.4The functionality and behavior of the AI system and its components – as identified in...	22	11	12 in force, 10 not yet in force
	The 22 laws behind 4.1 and MEASURE 2.4 Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 12 (record-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 19 (automatically generated logs), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(6) (deployer log-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months AI Act, Article 72 (post-market monitoring by providers and post-market monitoring plan), European Union from 2 Dec 2027, in 13 months and 12 more, every one in the free file.
	MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the...	18	16	17 in force, 1 not yet in force
	The 18 laws behind 4.1 and MAP 4.1 Code de droit économique, article XI.190, 20°, exception de fouille de textes et de données, Belgium Law on Copyright and Related Rights, Content Limitations (No Text-and-Data-Mining Exception), Bosnia and Herzegovina Copyright and Neighbouring Rights Act (ZAPSP), Arts. 26e, 26zh and 26k, Text-and-Data-Mining Exception for Crawling and Training, Bulgaria Copyright (Cayman Islands) Order 2015, text and data analysis exception, Cayman Islands Copyright Act 2013, economic rights, computer program copying, and technological protection measures, Cook Islands Autorský zákon Sections 39c-39d, Text and Data Mining Exception for Automated Analysis, Czech Republic AI Act, Article 53 (obligations for providers of general-purpose AI models), European Union Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union DSM Directive, Article 4 (text-and-data-mining exception and rights reservation), European Union Copyright Act 1999, Fair Dealing and Criminal Liability for Infringement, Fiji from a date not yet set and 8 more, every one in the free file.
	GOVERN 1.4The risk management process and its outcomes are established through transparent...	17	12	11 in force, 6 not yet in force
	The 17 laws behind 4.1 and GOVERN 1.4 Transparency in Frontier Artificial Intelligence Act (SB 53), California OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado AI Act, Article 17 (quality management system), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months AI Act, Article 9 (risk management system), European Union from 2 Dec 2027, in 13 months EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan and 7 more, every one in the free file.
	MAP 2.3Scientific integrity and TEVV considerations are identified and documented, including...	12	9	8 in force, 4 not yet in force
	The 12 laws behind 4.1 and MAP 2.3 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months AI Act, Article 53 (obligations for providers of general-purpose AI models), European Union Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Counter-Fraud Framework: fraud detection systems, machine learning and artificial intelligence, Saudi Arabia Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom and 2 more, every one in the free file.
	MEASURE 3.3Feedback processes for end users and impacted communities to report problems and...	10	10	3 in force, 1 not yet in force, 6 proposed
	The 10 laws behind 4.1 and MEASURE 3.3 Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Canada, Canada proposed Consumer Credit Act, Articles 24 and 30, Personalised Offers and Creditworthiness Assessment by Automated Processing, Croatia from 20 Nov 2026, in 4 weeks Council of Europe Framework Convention on AI, Georgia's signature, Georgia proposed FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Council of Europe Framework Convention on Artificial Intelligence, signed by Moldova, Moldova proposed Portuguese Charter of Human Rights in the Digital Era, Article 9, Use of Artificial Intelligence and Robots, Portugal Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Council of Europe Framework Convention on Artificial Intelligence, signed by the United Kingdom, United Kingdom proposed
	GOVERN 4.2Organizational teams document the risks and potential impacts of the AI technology...	8	6	4 in force, 3 not yet in force, 1 proposed
	The 8 laws behind 4.1 and GOVERN 4.2 Employment Technological Displacement Notice (SB 951), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Artificial Intelligence Video Interview Act, Illinois Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months S.B. 1090, SAFECHAT Act, Pennsylvania proposed AI Framework Act, Article 34 (business-operator duties for high-impact AI), South Korea
	GOVERN 1.6Mechanisms are in place to inventory AI systems and are resourced according to...	7	6	6 in force, 1 not yet in force
	The 7 laws behind 4.1 and GOVERN 1.6 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom Interagency Supervisory Guidance on Model Risk Management (2026 revision), United States
	GOVERN 2.1Roles and responsibilities and lines of communication related to mapping, measuring,...	7	6	7 in force
	The 7 laws behind 4.1 and GOVERN 2.1 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union MiFID II Suitability Assessment for Investment Advice and Portfolio Management, Including Automated and Semi-Automated Systems (Article 25(2) and Delegated Regulation 2017/565 Article 54), European Union Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Suitability for MiFID business: personal recommendations and decisions to trade, including advice given through an automated or semi-automated system, United Kingdom Interagency Supervisory Guidance on Model Risk Management (2026 revision), United States
	MEASURE 2.11Fairness and bias – as identified in the MAP function – are evaluated and results are...	6	5	4 in force, 2 not yet in force
	The 6 laws behind 4.1 and MEASURE 2.11 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
	MEASURE 2.9The AI model is explained, validated, and documented, and AI system output is...	5	5	5 in force
	The 5 laws behind 4.1 and MEASURE 2.9 Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom
	MAP 2.2Information about the AI system’s knowledge limits and how system output may be...	5	4	1 in force, 4 not yet in force
	The 5 laws behind 4.1 and MAP 2.2 Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California AI Act, Article 13 (transparency and provision of information to deployers), European Union from 2 Dec 2027, in 13 months Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Federal Law No. 243-FZ, Article 8, Duties of Sovereign and National Foundation Model Developers, Russia from 1 Mar 2027, in 4 months
	MAP 3.3Targeted application scope is specified and documented based on the system’s...	5	4	4 in force, 1 not yet in force
	The 5 laws behind 4.1 and MAP 3.3 Attorney, Court Filing and Arbitrator Generative AI Duties (SB 574), California from 1 Jan 2027, in 2 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Law on Artificial Intelligence, risk classification and conformity assessment, Vietnam
	MANAGE 2.4Mechanisms are in place and applied, and responsibilities are assigned and understood,...	5	4	5 in force
	The 5 laws behind 4.1 and MANAGE 2.4 Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model Management Standards: governance, validation and monitoring of the models a bank uses to decide, including artificial intelligence models, United Arab Emirates
	GOVERN 2.3Executive leadership of the organization takes responsibility for decisions about...	4	4	4 in force
	The 4 laws behind 4.1 and GOVERN 2.3 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
	MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are...	4	4	3 in force, 1 not yet in force
	The 4 laws behind 4.1 and MAP 1.6 Companion Chatbot Safety and Accountability Act (SB 243), California Artificial Intelligence Video Interview Act, Illinois Use of artificial intelligence in therapy or psychotherapy services, Maine AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months
	MAP 5.1Likelihood and magnitude of each identified impact (both potentially beneficial and...	3	3	3 in force
	The 3 laws behind 4.1 and MAP 5.1 Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
	MEASURE 2.6The AI system is evaluated regularly for safety risks – as identified in the MAP...	3	3	1 in force, 1 not yet in force, 1 proposed
	The 3 laws behind 4.1 and MEASURE 2.6 Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months S.B. 1090, SAFECHAT Act, Pennsylvania proposed
	MEASURE 2.5The AI system to be deployed is demonstrated to be valid and reliable. Limitations of...	2	2	2 in force
	The 2 laws behind 4.1 and MEASURE 2.5 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Interagency Supervisory Guidance on Model Risk Management (2026 revision), United States
	MEASURE 2.7AI system security and resilience – as identified in the MAP function – are evaluated...	2	2	1 in force, 1 not yet in force
	The 2 laws behind 4.1 and MEASURE 2.7 Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Federal Law No. 243-FZ, Article 8, Duties of Sovereign and National Foundation Model Developers, Russia from 1 Mar 2027, in 4 months
	MEASURE 2.10Privacy risk of the AI system – as identified in the MAP function – is examined and documented.	2	2	1 in force, 1 not yet in force
	The 2 laws behind 4.1 and MEASURE 2.10 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months
4.2Risk Disclosure	MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP...	64	43	40 in force, 12 not yet in force, 12 proposed
	The 64 laws behind 4.2 and MEASURE 2.8 Distribution of Materially Deceptive Media to Influence an Upcoming Election, Alabama SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Practice Direction No. 18 of 2025, ethical use of generative AI in court proceedings, Belize Attorney, Court Filing and Arbitrator Generative AI Duties (SB 574), California from 1 Jan 2027, in 2 months California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), California CCPA Automated Decisionmaking Technology Regulations, California Companion Chatbot Safety and Accountability Act (SB 243), California Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months and 54 more, every one in the free file.
	GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.	18	12	13 in force, 4 not yet in force, 1 proposed
	The 18 laws behind 4.2 and GOVERN 1.1 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Companion Chatbot Safety and Accountability Act (SB 243), California Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months HB 26-1263 (2026), Conversational AI Service Operator Requirements, Colorado AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(8) (public-authority deployer registration), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union and 8 more, every one in the free file.
	MEASURE 3.3Feedback processes for end users and impacted communities to report problems and...	10	10	3 in force, 1 not yet in force, 6 proposed
	The 10 laws behind 4.2 and MEASURE 3.3 Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Canada, Canada proposed Consumer Credit Act, Articles 24 and 30, Personalised Offers and Creditworthiness Assessment by Automated Processing, Croatia from 20 Nov 2026, in 4 weeks Council of Europe Framework Convention on AI, Georgia's signature, Georgia proposed Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Council of Europe Framework Convention on Artificial Intelligence, signed by Moldova, Moldova proposed Portuguese Charter of Human Rights in the Digital Era, Article 9, Use of Artificial Intelligence and Robots, Portugal Council of Europe Framework Convention on Artificial Intelligence, signed by the United Kingdom, United Kingdom proposed
	GOVERN 4.2Organizational teams document the risks and potential impacts of the AI technology...	10	7	6 in force, 3 not yet in force, 1 proposed
	The 10 laws behind 4.2 and GOVERN 4.2 Employment Technological Displacement Notice (SB 951), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California Digital Services Act, Article 37 (independent audit of very large online platforms and search engines), European Union Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Artificial Intelligence Video Interview Act, Illinois Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months S.B. 1090, SAFECHAT Act, Pennsylvania proposed AI Framework Act, Article 32 (safety-assurance duty for high-compute AI systems), South Korea AI Framework Act, Article 34 (business-operator duties for high-impact AI), South Korea
	MANAGE 4.3Incidents and errors are communicated to relevant AI actors, including affected...	8	6	4 in force, 3 not yet in force, 1 proposed
	The 8 laws behind 4.2 and MANAGE 4.3 Transparency in Frontier Artificial Intelligence Act (SB 53), California AI Act, Article 20 (corrective actions and duty of information), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan AI Framework Act, Article 32 (safety-assurance duty for high-compute AI systems), South Korea Artificial Intelligence Risk Management and Security Act of 2026, United States proposed
	MANAGE 4.1Post-deployment AI system monitoring plans are implemented, including mechanisms for...	5	5	5 in force
	The 5 laws behind 4.2 and MANAGE 4.1 Loi n° 09-04 relative à la prévention et à la lutte contre les infractions liées aux technologies de l'information et de la communication, Algeria MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Artificial Intelligence Video Interview Act, Illinois Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Code Pénal Arts. 294-3 to 294-4, Child Sexual Abuse Material Including Realistic and AI-Generated Depictions, Monaco
	MAP 2.2Information about the AI system’s knowledge limits and how system output may be...	4	3	1 in force, 3 not yet in force
	The 4 laws behind 4.2 and MAP 2.2 Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California AI Act, Article 13 (transparency and provision of information to deployers), European Union from 2 Dec 2027, in 13 months Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months
	MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are...	3	3	2 in force, 1 not yet in force
	The 3 laws behind 4.2 and MAP 1.6 Companion Chatbot Safety and Accountability Act (SB 243), California Artificial Intelligence Video Interview Act, Illinois AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months
	MAP 3.3Targeted application scope is specified and documented based on the system’s...	3	3	2 in force, 1 not yet in force
	The 3 laws behind 4.2 and MAP 3.3 Attorney, Court Filing and Arbitrator Generative AI Duties (SB 574), California from 1 Jan 2027, in 2 months Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Law on Artificial Intelligence, risk classification and conformity assessment, Vietnam
	GOVERN 4.3Organizational practices are in place to enable AI testing, identification of...	2	2	1 in force, 1 not yet in force
	The 2 laws behind 4.2 and GOVERN 4.3 Transparency in Frontier Artificial Intelligence Act (SB 53), California Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months
	MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with...	2	2	2 in force
	The 2 laws behind 4.2 and MAP 3.5 Practice Direction No. 18 of 2025, ethical use of generative AI in court proceedings, Belize Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica
	MEASURE 2.4The functionality and behavior of the AI system and its components – as identified in...	2	2	2 in force
	The 2 laws behind 4.2 and MEASURE 2.4 Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius
	MEASURE 2.6The AI system is evaluated regularly for safety risks – as identified in the MAP...	2	2	1 not yet in force, 1 proposed
	The 2 laws behind 4.2 and MEASURE 2.6 AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months S.B. 1090, SAFECHAT Act, Pennsylvania proposed
	MEASURE 2.9The AI model is explained, validated, and documented, and AI system output is...	2	2	2 in force
	The 2 laws behind 4.2 and MEASURE 2.9 Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
	MANAGE 2.4Mechanisms are in place and applied, and responsibilities are assigned and understood,...	2	2	1 in force, 1 not yet in force
	The 2 laws behind 4.2 and MANAGE 2.4 AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius
4.3Incident Reporting	GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.	15	11	12 in force, 2 not yet in force, 1 proposed
	The 15 laws behind 4.3 and GOVERN 1.1 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Companion Chatbot Safety and Accountability Act (SB 243), California Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months HB 26-1263 (2026), Conversational AI Service Operator Requirements, Colorado AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Ordonnance n°0011/PR/2026, marquage des contenus générés par intelligence artificielle, Gabon Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany and 5 more, every one in the free file.
	MANAGE 4.3Incidents and errors are communicated to relevant AI actors, including affected...	9	7	5 in force, 3 not yet in force, 1 proposed
	The 9 laws behind 4.3 and MANAGE 4.3 Transparency in Frontier Artificial Intelligence Act (SB 53), California AI Act, Article 20 (corrective actions and duty of information), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan AI Framework Act, Article 32 (safety-assurance duty for high-compute AI systems), South Korea Artificial Intelligence Risk Management and Security Act of 2026, United States proposed Law on Artificial Intelligence, incident management and reporting obligation, Vietnam
	GOVERN 4.2Organizational teams document the risks and potential impacts of the AI technology...	8	6	5 in force, 3 not yet in force
	The 8 laws behind 4.3 and GOVERN 4.2 Employment Technological Displacement Notice (SB 951), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California Digital Services Act, Article 37 (independent audit of very large online platforms and search engines), European Union Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Artificial Intelligence Video Interview Act, Illinois Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months AI Framework Act, Article 32 (safety-assurance duty for high-compute AI systems), South Korea
	MANAGE 4.1Post-deployment AI system monitoring plans are implemented, including mechanisms for...	6	6	6 in force
	The 6 laws behind 4.3 and MANAGE 4.1 Loi n° 09-04 relative à la prévention et à la lutte contre les infractions liées aux technologies de l'information et de la communication, Algeria MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Artificial Intelligence Video Interview Act, Illinois Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Code Pénal Arts. 294-3 to 294-4, Child Sexual Abuse Material Including Realistic and AI-Generated Depictions, Monaco Law on Artificial Intelligence, incident management and reporting obligation, Vietnam
	GOVERN 4.3Organizational practices are in place to enable AI testing, identification of...	2	2	1 in force, 1 not yet in force
	The 2 laws behind 4.3 and GOVERN 4.3 Transparency in Frontier Artificial Intelligence Act (SB 53), California Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months
4.4Governance Disclosure	GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.	4	3	2 in force, 2 not yet in force
4.4Governance Disclosure	The 4 laws behind 4.4 and GOVERN 1.1 AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(8) (public-authority deployer registration), European Union from 2 Dec 2027, in 13 months Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius Digital Transformation Act 2025, ICT service permit for AI and AI-related data services, Vanuatu
4.5Third-Party System Access	GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.	15	11	12 in force, 2 not yet in force, 1 proposed
	The 15 laws behind 4.5 and GOVERN 1.1 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Companion Chatbot Safety and Accountability Act (SB 243), California Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months HB 26-1263 (2026), Conversational AI Service Operator Requirements, Colorado AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Ordonnance n°0011/PR/2026, marquage des contenus générés par intelligence artificielle, Gabon Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany and 5 more, every one in the free file.
	GOVERN 4.2Organizational teams document the risks and potential impacts of the AI technology...	8	6	5 in force, 3 not yet in force
	The 8 laws behind 4.5 and GOVERN 4.2 Employment Technological Displacement Notice (SB 951), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California Digital Services Act, Article 37 (independent audit of very large online platforms and search engines), European Union Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Artificial Intelligence Video Interview Act, Illinois Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months AI Framework Act, Article 32 (safety-assurance duty for high-compute AI systems), South Korea
	MANAGE 4.3Incidents and errors are communicated to relevant AI actors, including affected...	8	6	4 in force, 3 not yet in force, 1 proposed
	The 8 laws behind 4.5 and MANAGE 4.3 Transparency in Frontier Artificial Intelligence Act (SB 53), California AI Act, Article 20 (corrective actions and duty of information), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan AI Framework Act, Article 32 (safety-assurance duty for high-compute AI systems), South Korea Artificial Intelligence Risk Management and Security Act of 2026, United States proposed
	MANAGE 4.1Post-deployment AI system monitoring plans are implemented, including mechanisms for...	5	5	5 in force
	The 5 laws behind 4.5 and MANAGE 4.1 Loi n° 09-04 relative à la prévention et à la lutte contre les infractions liées aux technologies de l'information et de la communication, Algeria MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Artificial Intelligence Video Interview Act, Illinois Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Code Pénal Arts. 294-3 to 294-4, Child Sexual Abuse Material Including Realistic and AI-Generated Depictions, Monaco
	GOVERN 4.3Organizational practices are in place to enable AI testing, identification of...	2	2	1 in force, 1 not yet in force
	The 2 laws behind 4.5 and GOVERN 4.3 Transparency in Frontier Artificial Intelligence Act (SB 53), California Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months
4.6User Rights & Recourse	MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP...	84	52	56 in force, 15 not yet in force, 1 blocked by a court, 12 proposed
	The 84 laws behind 4.6 and MEASURE 2.8 Distribution of Materially Deceptive Media to Influence an Upcoming Election, Alabama SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Practice Direction No. 18 of 2025, ethical use of generative AI in court proceedings, Belize TSE Resolution, AI-Generated Content Disclosure Duty, Brazil AB 2839, election materially deceptive deepfake disclaimer law, California blocked by a court AB 730, as extended by AB 972, election deepfake disclosure law, California Attorney, Court Filing and Arbitrator Generative AI Duties (SB 574), California from 1 Jan 2027, in 2 months California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), California and 74 more, every one in the free file.
	MEASURE 3.3Feedback processes for end users and impacted communities to report problems and...	10	10	2 in force, 2 not yet in force, 6 proposed
	The 10 laws behind 4.6 and MEASURE 3.3 Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Canada, Canada proposed Consumer Credit Act, Articles 24 and 30, Personalised Offers and Creditworthiness Assessment by Automated Processing, Croatia from 20 Nov 2026, in 4 weeks Council of Europe Framework Convention on AI, Georgia's signature, Georgia proposed FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Council of Europe Framework Convention on Artificial Intelligence, signed by Moldova, Moldova proposed Portuguese Charter of Human Rights in the Digital Era, Article 9, Use of Artificial Intelligence and Robots, Portugal Consumer Credit Act (2026:1011), Chapter 2 Section 7 and Chapter 3 Section 15, Personalised Offers and Credit Assessment by Automated Processing, Sweden from 20 Nov 2026, in 4 weeks Council of Europe Framework Convention on Artificial Intelligence, signed by the United Kingdom, United Kingdom proposed
	GOVERN 4.2Organizational teams document the risks and potential impacts of the AI technology...	8	6	4 in force, 3 not yet in force, 1 proposed
	The 8 laws behind 4.6 and GOVERN 4.2 Employment Technological Displacement Notice (SB 951), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Artificial Intelligence Video Interview Act, Illinois Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months S.B. 1090, SAFECHAT Act, Pennsylvania proposed AI Framework Act, Article 34 (business-operator duties for high-impact AI), South Korea
	MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are...	6	6	3 in force, 3 not yet in force
	The 6 laws behind 4.6 and MAP 1.6 Companion Chatbot Safety and Accountability Act (SB 243), California HB 26-1263 (2026), Conversational AI Service Operator Requirements, Colorado Conversational AI Safety Act, Idaho from 1 Jul 2027, in 8 months Artificial Intelligence Video Interview Act, Illinois Conversational AI Services Act (Senate File 2417), Iowa from 1 Jul 2027, in 8 months AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months
	MEASURE 2.6The AI system is evaluated regularly for safety risks – as identified in the MAP...	5	5	1 in force, 3 not yet in force, 1 proposed
	The 5 laws behind 4.6 and MEASURE 2.6 HB 26-1263 (2026), Conversational AI Service Operator Requirements, Colorado Conversational AI Safety Act, Idaho from 1 Jul 2027, in 8 months Conversational AI Services Act (Senate File 2417), Iowa from 1 Jul 2027, in 8 months AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months S.B. 1090, SAFECHAT Act, Pennsylvania proposed
	MEASURE 2.9The AI model is explained, validated, and documented, and AI system output is...	5	5	2 in force, 3 not yet in force
	The 5 laws behind 4.6 and MEASURE 2.9 CCPA Automated Decisionmaking Technology Regulations, California Consumer Credit Act, Articles 24 and 30, Personalised Offers and Creditworthiness Assessment by Automated Processing, Croatia from 20 Nov 2026, in 4 weeks AI Act, Article 86 (right to explanation of individual decision-making), European Union from 2 Dec 2027, in 13 months Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Consumer Credit Act (2026:1011), Chapter 2 Section 7 and Chapter 3 Section 15, Personalised Offers and Credit Assessment by Automated Processing, Sweden from 20 Nov 2026, in 4 weeks
	MAP 2.2Information about the AI system’s knowledge limits and how system output may be...	4	3	1 in force, 3 not yet in force
	The 4 laws behind 4.6 and MAP 2.2 Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California AI Act, Article 13 (transparency and provision of information to deployers), European Union from 2 Dec 2027, in 13 months Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months
	MAP 3.3Targeted application scope is specified and documented based on the system’s...	3	3	1 in force, 2 not yet in force
	The 3 laws behind 4.6 and MAP 3.3 Attorney, Court Filing and Arbitrator Generative AI Duties (SB 574), California from 1 Jan 2027, in 2 months Conversational AI Safety Act, Idaho from 1 Jul 2027, in 8 months Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
	MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with...	2	2	2 in force
	The 2 laws behind 4.6 and MAP 3.5 Practice Direction No. 18 of 2025, ethical use of generative AI in court proceedings, Belize Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica

Not connected to the NIST AI RMF: 5 of MIT mitigations' controls

No law we track reaches these

No duty in the laws we track reaches these controls.

1.3 Conflict of Interest Protections
1.4 Whistleblower Reporting & Protection
1.6 Environmental Impact Management
2.2 Model Alignment
3.4 Staged Deployment

How these connections are drawn

Each requirement line in the laws we track is read against the framework for its subject (the AI, scraping and news aggregation laws against the NIST AI RMF, the privacy, communications and age assurance laws against the NIST Privacy Framework, the cybersecurity laws against the NIST CSF 2.0); laws on liability and content moderation are not read against any framework yet. A line reaches the MIT mitigations through a kind of duty its law carries, and only where that kind of duty also reaches, on that same line, the NIST framework for the line's own subject. Two controls connect when lines in at least 2 laws reach both. That says the same duties reach both; it does not say the two are alike, or that running either one does what a law asks.

Every duty line in the AI, scraping and news aggregation laws we track has been read against the framework for its subject.

Sources and licenses

MIT AI Risk Initiative (MIT FutureTech), AI Risk Mitigation Taxonomy. Data from the MIT AI Risk Initiative is licensed under CC BY 4.0. Cite as: Mapping AI Risk Mitigations: Evidence Scan & Draft Mitigation Taxonomy