Law / Frameworks / Crosswalk / MIT mitigations to OWASP Agentic Top 10

The MIT AI Risk Mitigation Taxonomy, mapped to the OWASP Top 10 for Agentic Applications

16 of MIT mitigations' controls connect to 4 of OWASP Agentic Top 10's through 266 laws in 132 jurisdictions. Two controls connect when the same duties, in at least 2 laws we track, reach both. The connections are our own reading of the law; no framework publisher has reviewed or endorsed them.

From: MIT AI Risk Mitigation Taxonomy, preliminary taxonomy, July 2025, MIT AI Risk Initiative
To: OWASP Top 10 for Agentic Applications, 2026 edition, December 2025, OWASP GenAI Security Project
See also: OWASP Agentic Top 10 to MIT mitigations, the other way · every pair in the crosswalk · law library as of 19 Oct 2026

Download this mapping, with every law behind each connection: owasp-agentic-top-10--mit-ai-risk-mitigations.csv · owasp-agentic-top-10--mit-ai-risk-mitigations.json

MIT mitigations	OWASP Agentic Top 10	Laws	Jurisdictions	Where the laws stand
1.1Board Structure & Oversight	ASI09Human-Agent Trust Exploitation	78	37	50 in force, 27 not yet in force, 1 proposed
1.1Board Structure & Oversight	The 78 laws behind 1.1 and ASI09 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
1.2Risk Management	ASI09Human-Agent Trust Exploitation	78	37	50 in force, 27 not yet in force, 1 proposed
1.2Risk Management	The 78 laws behind 1.2 and ASI09 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
2.1Model & Infrastructure Security	ASI03Identity and Privilege Abuse	148	108	144 in force, 4 not yet in force
	The 148 laws behind 2.1 and ASI03 Penal Code, Part Twelve, Chapter One (Cyber Crimes and Punishment), Afghanistan Alabama Digital Crime Act, Computer Tampering, Alabama Criminal mischief in the fourth degree, unauthorized computer access, Alaska Criminal use of a computer, Alaska Theft of services, unauthorized use of a computer system, Alaska Copyright Law, Sui Generis Database Producers Rights, Albania Criminal Code, Unauthorized Computer Access, Albania Code pénal, atteintes aux systèmes de traitement automatisé de données, Algeria Ordonnance n° 03-05, exception de citation, Algeria Ordonnance n° 03-05, protection des bases de données, Algeria and 138 more, every one in the free file.
	ASI01Agent Goal Hijack	3	2	2 in force, 1 not yet in force
	The 3 laws behind 2.1 and ASI01 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	ASI04Agentic Supply Chain Vulnerabilities	3	2	2 in force, 1 not yet in force
	The 3 laws behind 2.1 and ASI04 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
2.3Model Safety Engineering	ASI09Human-Agent Trust Exploitation	5	5	2 in force, 3 not yet in force
	The 5 laws behind 2.3 and ASI09 HB 26-1263 (2026), Conversational AI Service Operator Requirements, Colorado Conversational AI Safety Act, Idaho from 1 Jul 2027, in 8 months Conversational AI Services Act (Senate File 2417), Iowa from 1 Jul 2027, in 8 months Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months
	ASI01Agent Goal Hijack	3	2	2 in force, 1 not yet in force
	The 3 laws behind 2.3 and ASI01 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	ASI03Identity and Privilege Abuse	3	2	2 in force, 1 not yet in force
	The 3 laws behind 2.3 and ASI03 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	ASI04Agentic Supply Chain Vulnerabilities	3	2	2 in force, 1 not yet in force
	The 3 laws behind 2.3 and ASI04 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
2.4Content Safety Controls	ASI09Human-Agent Trust Exploitation	43	33	30 in force, 8 not yet in force, 1 blocked by a court, 4 proposed
2.4Content Safety Controls	The 43 laws behind 2.4 and ASI09 Distribution of Materially Deceptive Media to Influence an Upcoming Election, Alabama TSE Resolution, AI-Generated Content Disclosure Duty, Brazil AB 2839, election materially deceptive deepfake disclaimer law, California blocked by a court AB 730, as extended by AB 972, election deepfake disclosure law, California California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), California Synthetic Performer Advertising Disclosure Act (SB 1050), California from 1 Jan 2027, in 2 months HB 26-1263 (2026), Conversational AI Service Operator Requirements, Colorado Act Implementing the European Media Freedom Act, Article 23, Labelling of AI-Generated Content, Croatia AI Act, Article 50 (transparency obligations for AI systems and synthetic content), European Union Digital Services Act, Article 35(1)(k) (systemic risk mitigation, synthetic media marking), European Union and 33 more, every one in the free file.
3.1Testing & Auditing	ASI01Agent Goal Hijack	3	2	2 in force, 1 not yet in force
	The 3 laws behind 3.1 and ASI01 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	ASI03Identity and Privilege Abuse	3	2	2 in force, 1 not yet in force
	The 3 laws behind 3.1 and ASI03 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	ASI04Agentic Supply Chain Vulnerabilities	3	2	2 in force, 1 not yet in force
	The 3 laws behind 3.1 and ASI04 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	ASI09Human-Agent Trust Exploitation	2	1	2 in force
	The 2 laws behind 3.1 and ASI09 Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy
3.2Data Governance	ASI03Identity and Privilege Abuse	145	107	142 in force, 3 not yet in force
	The 145 laws behind 3.2 and ASI03 Penal Code, Part Twelve, Chapter One (Cyber Crimes and Punishment), Afghanistan Alabama Digital Crime Act, Computer Tampering, Alabama Criminal mischief in the fourth degree, unauthorized computer access, Alaska Criminal use of a computer, Alaska Theft of services, unauthorized use of a computer system, Alaska Copyright Law, Sui Generis Database Producers Rights, Albania Criminal Code, Unauthorized Computer Access, Albania Code pénal, atteintes aux systèmes de traitement automatisé de données, Algeria Ordonnance n° 03-05, exception de citation, Algeria Ordonnance n° 03-05, protection des bases de données, Algeria and 135 more, every one in the free file.
	ASI09Human-Agent Trust Exploitation	6	3	4 in force, 2 not yet in force
	The 6 laws behind 3.2 and ASI09 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Use of artificial intelligence in therapy or psychotherapy services, Maine
3.3Access Management	ASI09Human-Agent Trust Exploitation	4	2	2 in force, 2 not yet in force
3.3Access Management	The 4 laws behind 3.3 and ASI09 AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy
3.5Post-deployment Monitoring	ASI09Human-Agent Trust Exploitation	78	37	50 in force, 27 not yet in force, 1 proposed
3.5Post-deployment Monitoring	The 78 laws behind 3.5 and ASI09 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months and 68 more, every one in the free file.
3.6Incident Response & Recovery	ASI01Agent Goal Hijack	3	2	2 in force, 1 not yet in force
	The 3 laws behind 3.6 and ASI01 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	ASI03Identity and Privilege Abuse	3	2	2 in force, 1 not yet in force
	The 3 laws behind 3.6 and ASI03 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	ASI04Agentic Supply Chain Vulnerabilities	3	2	2 in force, 1 not yet in force
	The 3 laws behind 3.6 and ASI04 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
4.1System Documentation	ASI09Human-Agent Trust Exploitation	101	46	64 in force, 32 not yet in force, 5 proposed
	The 101 laws behind 4.1 and ASI09 Distribution of Materially Deceptive Media to Influence an Upcoming Election, Alabama SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), California Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months Synthetic Performer Advertising Disclosure Act (SB 1050), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada and 91 more, every one in the free file.
	ASI03Identity and Privilege Abuse	3	3	3 in force
	The 3 laws behind 4.1 and ASI03 Copyright Act 2013, economic rights, computer program copying, and technological protection measures, Cook Islands Schutz technischer Massnahmen und Durchsetzung von Schrankenbestimmungen (Protection of Technological Measures), Germany Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
4.2Risk Disclosure	ASI09Human-Agent Trust Exploitation	38	27	25 in force, 8 not yet in force, 5 proposed
4.2Risk Disclosure	The 38 laws behind 4.2 and ASI09 Distribution of Materially Deceptive Media to Influence an Upcoming Election, Alabama SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), California Synthetic Performer Advertising Disclosure Act (SB 1050), California from 1 Jan 2027, in 2 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Article 50 (transparency obligations for AI systems and synthetic content), European Union AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union and 28 more, every one in the free file.
4.3Incident Reporting	ASI09Human-Agent Trust Exploitation	13	10	9 in force, 3 not yet in force, 1 proposed
4.3Incident Reporting	The 13 laws behind 4.3 and ASI09 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius and 3 more, every one in the free file.
4.4Governance Disclosure	ASI09Human-Agent Trust Exploitation	3	3	2 in force, 1 not yet in force
4.4Governance Disclosure	The 3 laws behind 4.4 and ASI09 AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius Digital Transformation Act 2025, ICT service permit for AI and AI-related data services, Vanuatu
4.5Third-Party System Access	ASI09Human-Agent Trust Exploitation	13	10	9 in force, 3 not yet in force, 1 proposed
4.5Third-Party System Access	The 13 laws behind 4.5 and ASI09 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings, Hungary Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius and 3 more, every one in the free file.
4.6User Rights & Recourse	ASI09Human-Agent Trust Exploitation	45	35	32 in force, 8 not yet in force, 1 blocked by a court, 4 proposed
4.6User Rights & Recourse	The 45 laws behind 4.6 and ASI09 Distribution of Materially Deceptive Media to Influence an Upcoming Election, Alabama TSE Resolution, AI-Generated Content Disclosure Duty, Brazil AB 2839, election materially deceptive deepfake disclaimer law, California blocked by a court AB 730, as extended by AB 972, election deepfake disclosure law, California California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), California Synthetic Performer Advertising Disclosure Act (SB 1050), California from 1 Jan 2027, in 2 months HB 26-1263 (2026), Conversational AI Service Operator Requirements, Colorado Act Implementing the European Media Freedom Act, Article 23, Labelling of AI-Generated Content, Croatia AI Act, Article 50 (transparency obligations for AI systems and synthetic content), European Union Digital Services Act, Article 35(1)(k) (systemic risk mitigation, synthetic media marking), European Union and 35 more, every one in the free file.

Not connected to the OWASP Agentic Top 10: 7 of MIT mitigations' controls

Short of 2 laws

The same duties reach these and a OWASP Agentic Top 10 control, in fewer than 2 of the laws we track.

1.7 Societal Impact Assessment: with ASI09 through Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy

No OWASP Agentic Top 10 control on the same duties

Laws reach these, but no duty that reaches one of them also reaches a OWASP Agentic Top 10 control.

1.5 Safety Decision Frameworks, 143 laws

No law we track reaches these

No duty in the laws we track reaches these controls.

1.3 Conflict of Interest Protections
1.4 Whistleblower Reporting & Protection
1.6 Environmental Impact Management
2.2 Model Alignment
3.4 Staged Deployment

How these connections are drawn

Each requirement line in the laws we track is read against the framework for its subject (the AI, scraping and news aggregation laws against the NIST AI RMF, the privacy, communications and age assurance laws against the NIST Privacy Framework, the cybersecurity laws against the NIST CSF 2.0); laws on liability and content moderation are not read against any framework yet. A line reaches either framework through a kind of duty its law carries, and only where that kind of duty also reaches, on that same line, the NIST framework for the line's own subject. Two controls connect when lines in at least 2 laws reach both. That says the same duties reach both; it does not say the two are alike, or that running either one does what a law asks.

Every duty line in the AI, scraping and news aggregation laws we track has been read against the framework for its subject.

Sources and licenses

MIT AI Risk Initiative (MIT FutureTech), AI Risk Mitigation Taxonomy. Data from the MIT AI Risk Initiative is licensed under CC BY 4.0. Cite as: Mapping AI Risk Mitigations: Evidence Scan & Draft Mitigation Taxonomy

OWASP GenAI Security Project, Agentic Security Initiative, OWASP Top 10 for Agentic Applications 2026, licensed CC BY-SA 4.0. Excerpted: only the first paragraph of each entry's Description is reproduced, verbatim.