NIST AI RMF, MapMAP 2.3

If you are a health benefit plan provider using artificial intelligence to make medical-necessity determinations on prior-authorization requests, base each determination on the enrollee's own medical history, the clinical circumstances the treating provider presents, and other clinical information in the enrollee's record, not a group dataset.

Data used to develop a model should be suitable for its intended use: accurate and fit for use, relevant and representative, compliant with statutory, regulatory and internal requirements for data ethics and customer privacy, traceable and timely.

Draw on holistic and current data sources for detection, including customer products and services held across all lines of business, all contact channels, external information, the insights gathered from Intelligence Monitoring, transactional or settlement data and non-transactional data, and put controls in place so that the data supplied to the detection system is timely, complete and accurate (Sections 5.2(c) and 5.2(d)).

Make sure AI and ML systems do not result in discriminatory or manipulative outcomes, train models on data that is sufficiently accurate, relevant and representative of the customer populations they are applied to, and test AI once a year or each time a model is upgraded, materially changed or introduced to identify and remediate undue or unintended biases (Sections 3(a) to 3(c)).

Develop models under documented standards: a clear statement of purpose and design objectives, development data shown to be suitable, representative and free of inappropriate bias and used in compliance with data privacy and other relevant data regulations, development testing against the design objectives including for material changes in dynamic models that adapt, recalibrate or change autonomously, justified and recorded expert-judgement adjustments, and documentation detailed enough for an independent third party to understand and replicate the model (Principle 3).

If you are a bank, the agencies say you should ensure that alternative data usage comports with safe and sound operations, with data controls that include rigorous assessment of the quality and suitability of data, and that the federal banking agencies' model risk management guidance contains principles for managing the risk of models that may leverage alternative data; the statement's footnote cites the 2011 and 2017 guidance that the April 17, 2026 revision superseded.

Ensure that an AI system used for utilization review makes determinations based on the patient's medical or clinical history, individual clinical circumstances and other relevant clinical factors, with any denial of coverage reviewed by a licensed clinician, physician or other competent regulated professional

Do not base a utilization review determination solely on group data without reference to the individual's data, and do not use the system in a way that discriminates against individuals in violation of state or federal law

If you are the provider of a high-risk AI system that uses techniques involving the training of AI models, develop it on training, validation and testing data sets that meet the criteria below, whenever you use such data sets.

Apply data governance and management practices appropriate to the system's intended purpose, covering your design choices; how you collected the data and, for personal data, why you originally collected it; your data-preparation operations, such as annotation, labelling, cleaning, updating, enrichment and aggregation; the assumptions you made about what the data measures and represents; an assessment of whether the data sets you need are available, sufficient in quantity, and suitable; examination of the data for biases likely to affect health and safety, harm fundamental rights, or lead to discrimination prohibited under Union law, especially where one operation's data outputs become a later operation's inputs; and measures to detect, prevent and mitigate any bias you find.

If you are the deployer of a high-risk AI system and you exercise control over its input data, ensure that input data is relevant and sufficiently representative in view of the system's intended purpose.

Base any determination an AI, algorithm, or other software tool makes in utilization review on the enrollee's own medical or clinical history, individual clinical circumstances, or other relevant clinical information in the enrollee's record, never solely on a group dataset.

Post training-data documentation on your website before making a generative AI system publicly available to Californians, and again before any substantial modification

Cover the datasets and their sources and owners, an approximate count and description of the data points, whether the data includes copyrighted or personal information, and whether synthetic data generation was used

Publish a training-content summary if you provide a general-purpose model

Publicly post documentation describing the datasets used to train a generative AI model or service made available to New York users, including their sources, whether they contain copyrighted, personal or aggregate consumer information, the collection period, and whether synthetic data generation was used.

A provider that meets the open-source conditions remains bound by the Article 53(1), point (c), duty to put in place a copyright policy, including identifying and complying with a reservation of rights under Article 4(3) of Directive (EU) 2019/790, and by the point (d) duty to produce a summary of the content used for training (Section 4.1, paragraph 72).

A provider of a general-purpose AI model placed on the market before 2 August 2025 must take the necessary steps to comply by 2 August 2027 and is not required to retrain or unlearn the model where that is not possible, where information about the training data is unavailable or where retrieval would cause disproportionate burden, but must clearly disclose and justify each such instance in the copyright policy and the training-content summary (Section 5.3, paragraphs 106 and 108).

Verify and maintain oversight of the data your AI systems process so that outputs remain correct, reliable, and obtained transparently.

Only process truthful, complete, exact, updated, verifiable and understandable personal data in an artificial intelligence system, and do not process partial, incomplete, fragmented or misleading personal data.

If you develop a generative AI system made available to Californians, publicly post documentation of your training datasets before each release or substantial modification, starting January 1, 2026.

Publish on your website a summary of the training data used for your generative AI system; compliance was required by 1 January 2026.