Law / Frameworks / NIST AI RMF / Govern
NIST AI RMF, GovernGOVERN 2.1
Roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks are documented and are clear to individuals and teams throughout the organization.NIST AI Risk Management Framework, version 1.0, January 2023 (NIST AI 100-1), GOVERN 2.1
We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Corpus as of .
- 2
- laws
- 2
- places
- 0
- with court rulings behind them
- 1
- not yet in force
The same ground elsewhere linked through the kinds of duty both controls are mapped from
- NIST AI 600-1GAI-RISK-07 Human-AI Configuration
- OWASP LLM Top 10LLM03:2026 Excessive Agency
- OWASP Agentic Top 10ASI09 Human-Agent Trust Exploitation
- MIT mitigations1.1 Board Structure & Oversight
- MIT mitigations1.2 Risk Management
- NIST Privacy FrameworkID.IM-P4 Data actions of the systems/products/services are inventoried.
- NIST Privacy FrameworkGV.PO-P1 Organizational privacy values and policies (e.g., conditions on data processing such...
- NIST CSF 2.0GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including...
- NIST CSF 2.0GV.RR-01 Organizational leadership is responsible and accountable for cybersecurity risk and...
A law in force is unmarked; the rest wear their state: not yet in force
AI governance
1 law, 1 place| Place | Law | What it asks, as read here |
|---|---|---|
 Connecticut |
Frontier Developer Catastrophic-Risk Whistleblower Protections from , in 2 days |
Share each report and update with your officers and directors at least quarterly, withholding it from any officer or director the report accuses of wrongdoing. |
Personal data
1 law, 1 place| Place | Law | What it asks, as read here |
|---|---|---|
 Canada |
Personal Information Protection and Electronic Documents Act (PIPEDA), scraped personal data |
Apply PIPEDA's purpose-limitation and accountability obligations to personal information collected by crawling, the same as personal information collected any other way. |
Full text of the NIST AI Risk Management Framework, public domain (a US government work). Every control of the framework.