NIST AI RMF, GovernGOVERN 1.4

If passed as introduced, an operator of a high-risk AI system would need a risk-management system, data governance conforming to recognized standards, technical documentation, usage logs, transparency and human-oversight mechanisms, accuracy and cybersecurity standards, contingency measures to disable or recall the system, and post-market monitoring.

If you are the provider of a high-risk AI system, establish, implement, document, and maintain a risk management system for it, run as a continuous process across its whole lifecycle with regular review and updates.

An owner of such a heightened-risk system must meet the Cabinet of Ministers' risk-management, transparency, accuracy, reliability, data-quality and technical-documentation requirements, keep operating logs, and declare conformity in a signed digital document published on the owner's site before the system is deployed.

If a deployer of a critical artificial intelligence system controls, in whole or in part, a critical infrastructure facility, develop a risk management policy after deploying the system

The policy must be reasonable and consider a nationally or internationally recognized AI risk management framework, such as the NIST AI risk management framework

If you provide high-impact AI, or a product or service that uses it, establish and operate a risk-management plan for it.

If you are a large frontier developer (a frontier developer whose group had annual gross revenues over $500,000,000 in the prior calendar year), write, implement and publish on your website a frontier AI framework describing how you define and assess catastrophic-risk thresholds for your frontier models and apply mitigations, and review that framework at least once a year

If you are a large frontier developer, from 1 January 2028 write, implement, comply with and publish on your website a frontier AI framework covering catastrophic-risk assessment, mitigations, cybersecurity, internal governance, third-party evaluations, and risks from your own internal use of your frontier models.

If you are a large developer of a frontier AI model, write a safety and security protocol addressing severe risks and conspicuously publish it, with appropriate redactions, transmitting an unredacted copy to the Attorney General on request.

Once Article 8 of Federal Law No. 243-FZ takes effect on 1 March 2027: if you develop a sovereign or national large foundation AI model, take organizational and technical measures to secure it, define operating rules covering restrictions, conditions of use, updates, and decommissioning, and maintain technical documentation of its key parameters and limitations sufficient to assess the safety of its application.

Establish a documented, risk-based governance and risk management framework, including a cross-functional governance group drawing on legal, compliance, risk management, product development, underwriting, actuarial, data science, marketing, and customer service, designed to determine through quantitative testing whether your use of an external consumer data and information source, or an algorithm or predictive model that uses one, results in unfair discrimination with respect to race, and to remediate any discrimination detected.