NIST AI RMF, ManageMANAGE 4.1

On receiving a valid removal request, remove the image and make reasonable efforts to remove copies within forty-eight hours.

Remove a validly requested altered sexual depiction, and make reasonable efforts to remove known identical copies, within 48 hours of receiving the request.

As a telecommunications or electronic communications network operator or service provider, act to bar public access to such an image once you become aware of it through your professional activity, and make it available to the judicial authority.

If you own a website, application, or social media platform on which such material is disclosed, you are liable for damages if the depicted person requests removal and you fail to remove it, and known identical copies, within 72 hours.

Give users a clear way to report a non-consensual counterfeit intimate image and remove a reported image within 48 hours of notice, if you operate a covered platform

An operator of a website, online service, or application may not accept a fee or other consideration to remove, delete, or refrain from posting such an image when the depicted person requests it.

Let a consumer opt out of your use of ADMT to make a significant decision about them, unless you offer an appeal to a human reviewer with authority to overturn the decision or another exception listed in the regulation applies

If passed as introduced, an operator of a high-risk AI system would need a risk-management system, data governance conforming to recognized standards, technical documentation, usage logs, transparency and human-oversight mechanisms, accuracy and cybersecurity standards, contingency measures to disable or recall the system, and post-market monitoring.

Provide the system so the assigned overseers can decide, in a particular situation, not to use it, or can disregard, override or reverse its output.

Continuously keep your AI system safe, secure, and reliable, and promptly detect and remedy any incident capable of harming people, property, data, or social order, regardless of the system's risk tier.

If you discover a user has used the service to engage in illegal activity, warn the user, restrict their access to features, or suspend or terminate their access, in accordance with law and your service agreement.

Separately take measures against the responsible user, such as warning, restricting features, suspending the service, or closing the account, in accordance with law and your service agreement.

On receiving a report of explicit deep fake material, immediately confirm to the user that you are aware of it, remove the reported content and any identical known copies, and provide the user a written status update within seven days.

If you determine reported content is explicit deep fake material, take measures to keep the same material from being posted again.

As an internet access provider, remove or block access to illicit content as soon as you become aware of it, directly or indirectly (not only on judicial order), and assist the competent judicial authorities in an investigation.

As a service provider, remove or disable access to illegal content data disseminated by a third party through your systems once you obtain actual knowledge of it or a notice from a competent authority.

Delete an applicant's interview video, and instruct anyone else who received a copy to do the same, within 30 days of the applicant's request.

Stop processing an individual's already-public personal information once they expressly decline, even though no prior consent was required.