Law / Frameworks / NIST AI RMF / Govern
NIST AI RMF, GovernGOVERN 1.5
Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities clearly defined, including determining the frequency of periodic review.NIST AI Risk Management Framework, version 1.0, January 2023 (NIST AI 100-1), GOVERN 1.5
We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of .
- 7
- laws
- 7
- jurisdictions
- 0
- with court rulings behind them
- 1
- not yet in force
- 1
- proposed, not law
A law in force is unmarked; the rest wear their state: not yet in force proposed
AI sector rules
4 laws, 4 jurisdictions| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 Canada |
OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017) |
Models should be subject to a periodic review with a frequency consistent with their model risk materiality assessments. Internal audit, using individuals independent of model development, validation or use, should assess the effectiveness and adequacy of the model risk policy and compliance with it, including whether validation is independent and occurring on schedule and whether documentation and the model inventory records are consistent and complete. |
 United Arab Emirates |
Model Management Standards: governance, validation and monitoring of the models a bank uses to decide, including artificial intelligence models |
Have your internal audit function assess the regulatory compliance and the overall effectiveness of the model management framework as part of its regular auditing process (Section 3.1.9). |
 United Kingdom |
Model risk management principles for banks |
Have Internal Audit periodically assess the effectiveness of the framework across the model lifecycle and compliance with internal policies, and report its findings to the board and relevant committees on a timely basis (Principle 2.5). Make a report on the effectiveness of model risk management for financial reporting available to the audit committee on a regular basis, and at least annually, and on a timely basis for the external auditor's assessment (paragraph 3.8). +1 more |
 United States |
OCC Bulletin 2025-26: Model Risk Management, Clarification for Community Banks |
Set the frequency and scope of model validation by your own reasonable determination from those factors, without assuming that the OCC's guidance requires annual validation. |
AI governance
3 laws, 3 jurisdictions| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 California |
Transparency in Frontier Artificial Intelligence Act (SB 53) |
If you are a large frontier developer (a frontier developer whose group had annual gross revenues over $500,000,000 in the prior calendar year), write, implement and publish on your website a frontier AI framework describing how you define and assess catastrophic-risk thresholds for your frontier models and apply mitigations, and review that framework at least once a year |
 Massachusetts |
Transparency in Frontier Artificial Intelligence Act (proposed chapter 93M, Senate version of House bill 5576) proposed |
If you are a large frontier developer (a person that has trained a foundation model using more than 10^26 operations and, with its affiliates, has annual gross revenues above $500,000,000), write, implement, comply with, and publish a frontier AI framework describing how you assess and mitigate catastrophic risk, and review it at least annually. |
 New York |
Responsible AI Safety and Education Act (RAISE Act) from , in 7 weeks |
If you are a large frontier developer, review your frontier AI framework at least once a year, and publish any materially modified framework with a justification for the change within thirty days. |
Full text of the NIST AI Risk Management Framework, public domain (a US government work). Every control of the framework.