Law / Frameworks / NIST AI RMF / Measure

NIST AI RMF, MeasureMEASURE 2.3

AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s). Measures are documented.NIST AI Risk Management Framework, version 1.0, January 2023 (NIST AI 100-1), MEASURE 2.3

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of 14 Nov 2026.

6: laws
3: jurisdictions
0: with court rulings behind them
3: not yet in force

A law in force is unmarked; the rest wear their state: not yet in force

AI sector rules

4 laws, 3 jurisdictions

Jurisdiction	Law	What it asks, as read here
Canada	OSFI Guideline E-23, Model Risk Management (2027) from 1 May 2027, in 6 months	You should deploy models in an environment with quality and change control processes, test that the model operates as expected in production, document deployment procedures, and assess related risks such as cybersecurity risk and infrastructure vulnerabilities before deployment (see OSFI Guidelines B-13 and E-21).
European Union	EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance	Institutions should have in place internal policies and procedures ensuring that the quality of the model output is regularly assessed, using measures appropriate to the model's use, including backtesting the performance of the model (paragraph 54(c)).
European Union	MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6)	Test the conformance of your algorithmic trading systems and trading algorithms with the system of the trading venue when you access it as a member, when you connect to it through a sponsored access arrangement for the first time, when there is a material change of the venue's systems, and before you deploy or materially update the system, algorithm or strategy, and with the system of the direct market access provider when you first access the venue through direct market access, when there is a material change affecting its direct market access functionality, and before you deploy or materially update the system, algorithm or strategy (Article 6(1)); run the testing of the criteria in Article 5(4), points (a), (b) and (d), in an environment that is separated from your production environment (Article 7(1)); and before deploying a trading algorithm set predefined limits on the number of financial instruments being traded, the price, value and numbers of orders, the strategy positions and the number of trading venues to which orders are sent (Article 8).
United States	Interagency Supervisory Guidance on Model Risk Management (2026 revision)	Test a model as part of development, with rigor commensurate with the model's complexity and materiality.

AI risk obligations

2 laws, 1 jurisdiction

Jurisdiction	Law	What it asks, as read here
European Union	AI Act, Article 15 (accuracy, robustness and cybersecurity) from 2 Dec 2027, in 13 months	Declare the levels of accuracy and the relevant accuracy metrics of your high-risk AI system in its accompanying instructions of use.
European Union	AI Act, Article 9 (risk management system) from 2 Dec 2027, in 13 months	Test the system to confirm your risk management measures work, that the system performs consistently for its intended purpose, and that it meets the Section 2 requirements; you may use real-world testing under Article 60 for this. Test throughout development and, in any event, before placing the system on the market or putting it into service, against metrics and probabilistic thresholds set in advance.

Full text of the NIST AI Risk Management Framework, public domain (a US government work). Every control of the framework.