Law / Frameworks / NIST AI RMF / Manage

NIST AI RMF, ManageMANAGE 2.4

Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use.NIST AI Risk Management Framework, version 1.0, January 2023 (NIST AI 100-1), MANAGE 2.4

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of .

21
laws
11
jurisdictions
0
with court rulings behind them
6
not yet in force
2
proposed, not law

Related controls in other frameworks the same duties, in at least two laws we track, reach both

A law in force is unmarked; the rest wear their state: not yet in force proposed

  • European Union
  • France
  • Hungary
  • Italy
  • Jordan
  • Kyrgyzstan
  • Latvia
  • Mauritius
  • United Arab Emirates
  • United Kingdom

AI risk obligations

8 laws, 3 jurisdictions
JurisdictionLawWhat it asks, as read here
European Union AI Act, Article 14 (human oversight) from , in 13 months

Provide the system so the assigned overseers can intervene in its operation or interrupt it through a stop button or similar procedure that brings it to a halt in a safe state.

European Union AI Act, Article 20 (corrective actions and duty of information) from , in 13 months

If you are the provider of a high-risk AI system and consider, or have reason to consider, that a system you have placed on the market or put into service is not in conformity with the Regulation, immediately take the necessary corrective actions to bring it into conformity, withdraw it, disable it or recall it, as appropriate.

European Union AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring) from , in 13 months

Where you have reason to consider that using the system per its instructions may present a risk to health, safety or fundamental rights, inform the provider or distributor and the relevant market surveillance authority without undue delay, and suspend use of the system.

European Union AI Act, Article 26(10) (post-remote biometric identification authorisation) from , in 13 months

If the authorisation is rejected, stop the linked use immediately and delete the personal data the use generated.

European Union AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties) from , in 13 months

If you consider or have reason to consider that the system is not in conformity with the Regulation, take the necessary corrective actions and provide the information Article 20 requires.

European Union AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent)

Adopt immediate mitigation measures or, failing that, suspend the testing until mitigation takes place, or otherwise terminate it, and establish a procedure for the prompt recall of the AI system upon termination (Article 60(7)).

Italy Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10)

If the time limits are not observed or authorisation is refused, stop the use and delete the personal data, results and outputs, unless they are the body of the offence (art. 10, comma 2).

Kyrgyzstan Digital Code, Chapter 23: AI system design and risk-management obligations

A user of such a heightened-risk system must operate it per its instructions, keep the data it processes relevant, maintain effective human oversight and resourcing, immediately suspend use and notify the owner once it has grounds to believe use as instructed could cause harm to a protected interest, keep operating logs, and comply with a regulator's suspension order or a final court order to stop using the system.

AI sector rules

7 laws, 5 jurisdictions
JurisdictionLawWhat it asks, as read here
European Union MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6)

Be able to cancel immediately, as an emergency measure, any or all of your unexecuted orders submitted to any or all trading venues to which you are connected, including orders originating from individual traders, trading desks or clients (kill functionality), and be able to identify which trading algorithm and which trader, trading desk or client is responsible for each order that has been sent to a trading venue (Article 12).

Jordan Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0

The CBJ expects human-in-the-loop and human-on-the-loop mechanisms in proportion to the criticality and risk of each AI system, direct human oversight and intervention for critical systems, fallback procedures or human review, and contingency strategies including a kill switch (sections 5.2 and 5.4).

Mauritius Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021

Enter into a service-level agreement with each client before providing any services, stating any exclusivity agreements and the conditions or triggers that can discontinue the service and allow human judgment to be used or to replace it; display the Commission's notice that it does not vouch for the correctness of information on your robotic or artificial intelligence interface and that clients are not protected by statutory compensation arrangements in Mauritius, in the agreement, on your website and on your platform; and obtain each client's written confirmation, before providing services, that the client understands the scope, nature, risks and limitations of the advisory services (clause 11(3) to (6)).

Mauritius FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services

The Commission says that if you use third-party AI systems you should secure sufficient documentation and assurances on model behavior and compliance, and where appropriate consider system redundancy, mechanical monitoring of AI inputs and outputs, and kill switches that can deactivate the AI system under predefined conditions.

United Arab Emirates Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E.

Monitor AI continuously in accordance with the Model Management Standards, test automatic updates to AI tools before implementation, have mechanisms to detect, report and remediate performance issues, biases or unintended consequences before implementation and over time, and retain the clear and immediate ability, with human intervention, to cease use of an AI model, system, technology or application (Sections 6(a), 6(c), 6(d) and 6(f)).

United Arab Emirates Model Management Standards: governance, validation and monitoring of the models a bank uses to decide, including artificial intelligence models

Monitor the performance of your models on a regular basis, present monitoring reports to the Model Oversight Committee at least every quarter, and follow a clear process in which that Committee decides whether to continue using a model with further monitoring or to suspend it and work on remediation (Sections 3.6.1, 3.6.4 and 3.6.7).

United Kingdom Model risk management principles for banks

Have established policies and procedures for model risk mitigants when models under-perform: a consistent firm-wide process for post-model adjustments with independent review of all of them, consideration of restrictions on a model's use when significant deficiencies are found, and, for material models, defined exceptions and escalation procedures (Principle 5).

AI governance

4 laws, 4 jurisdictions
JurisdictionLawWhat it asks, as read here
France Projet de loi portant diverses dispositions d'adaptation au droit de l'Union européenne (DDADUE), Articles 24 to 24 terdecies, Authorities Competent Under the AI Act proposed

Carry out, within the time the authority sets, any measure it orders for a high-risk AI system used in critical infrastructure under proposed Article L. 1340-4 of the Code de la défense: ending the non-conformity, suspending or ceasing marketing or use, recalling or withdrawing the system, or publishing warnings (proposed Article L. 1340-5(V)).

Hungary Act LXXV of 2025 on the Domestic Implementation of the EU AI Regulation

Stop unlawful conduct or restore a lawful state when Hungary's AI market surveillance authority, the minister responsible for business development under Government Decree 344/2025 (X. 31.), so orders under Section 7(1) of Act LXXV of 2025; the same authority may also impose an administrative fine or declare your AI system's use unlawful.

Latvia Law on Digital Operational Resilience of the Financial Market and the Use of Artificial Intelligence, Articles 7, 8(5)-(7), 10(3)-(4) and 11(2)

Stop the activity immediately when the Bank of Latvia requires it after finding a breach (Article 10(4), point 1).

New York City Third-Party Validation and Shut-Down Capability of Artificial Intelligence Models proposed

It would make it unlawful to market, offer for sale, sell or deploy an artificial intelligence model that lacks a shut-down capability, the technical capability for a human operator to cause it to stop functioning temporarily or permanently.

AI prohibited practices

1 law, 1 jurisdiction
JurisdictionLawWhat it asks, as read here
Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13)

Stop the use at once, and delete the personal data, results and outputs, if the conditions or time limits are not met or authorisation is refused (art. 8, comma 8).

Data subject rights

1 law, 1 jurisdiction
JurisdictionLawWhat it asks, as read here
European Union Platform Work Directive, Transparency, Human Oversight and Human Review of Automated Systems (Articles 9 to 11) from , in 3 weeks

Where the oversight or evaluation identifies a high risk of discrimination at work in the use of your automated monitoring systems or automated decision-making systems, or finds that individual decisions have infringed the rights of a person performing platform work, take the steps necessary, including, if appropriate, the modification of the system or the discontinuation of its use, in order to avoid such decisions in the future (Article 10(3)).

Where a decision referred to in Article 11(1) infringes the rights of a person performing platform work, rectify it without delay and in any case within two weeks of its adoption; where rectification is not possible, offer adequate compensation for the damage sustained; and in any event take the steps necessary, including, if appropriate, the modification of the automated decision-making system or the discontinuation of its use, in order to avoid such decisions in the future (Article 11(3)).

Full text of the NIST AI Risk Management Framework, public domain (a US government work). Every control of the framework.