Law / Frameworks / NIST AI RMF / Measure

NIST AI RMF, MeasureMEASURE 1.3

Internal experts who did not serve as front-line developers for the system and/or independent assessors are involved in regular assessments and updates. Domain experts, users, AI actors external to the team that developed or deployed the AI system, and affected communities are consulted in support of assessments as necessary per organizational risk tolerance.NIST AI Risk Management Framework, version 1.0, January 2023 (NIST AI 100-1), MEASURE 1.3

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Corpus as of 29 Sep 2026.

2: laws
2: places
0: with court rulings behind them
1: not yet in force

A law in force is unmarked; the rest wear their state: not yet in force

AI governance

2 laws, 2 places

Place	Law	What it asks, as read here
European Union	Digital Services Act, Article 37 (independent audit of very large online platforms and search engines)	If you are a Commission-designated very large online platform or very large online search engine, commission an independent audit, at your own expense and at least once a year, of your compliance with Chapter III's due diligence obligations, including the systemic-risk mitigation measures for generated and manipulated content, and with any codes of conduct or crisis protocols you have joined. Select an auditing organisation that is independent of you and free of conflicts of interest: it must not have supplied you non-audit services in the twelve months before or after the audit, must not have audited you for more than ten consecutive years, and must not be paid on a result-contingent basis. +1 more
Illinois	Artificial Intelligence Safety Measures Act from 1 Jan 2027, in 3 months	If you are a large frontier developer, obtain an annual independent third-party audit of your compliance, and meet the Act's access, retention, and publication requirements for the audit results.

Place

Law

What it asks, as read here

European Union

Digital Services Act, Article 37 (independent audit of very large online platforms and search engines)

If you are a Commission-designated very large online platform or very large online search engine, commission an independent audit, at your own expense and at least once a year, of your compliance with Chapter III's due diligence obligations, including the systemic-risk mitigation measures for generated and manipulated content, and with any codes of conduct or crisis protocols you have joined.

Select an auditing organisation that is independent of you and free of conflicts of interest: it must not have supplied you non-audit services in the twelve months before or after the audit, must not have audited you for more than ten consecutive years, and must not be paid on a result-contingent basis.

+1 more

Illinois

Artificial Intelligence Safety Measures Act from 1 Jan 2027, in 3 months

If you are a large frontier developer, obtain an annual independent third-party audit of your compliance, and meet the Act's access, retention, and publication requirements for the audit results.

Full text of the NIST AI Risk Management Framework, public domain (a US government work). Every control of the framework.