Law / Frameworks / Crosswalk / NIST AI RMF to FINOS AIGF

The NIST AI Risk Management Framework, mapped to the FINOS AI Governance Framework

28 of NIST AI RMF's controls connect to 16 of FINOS AIGF's through 489 laws in 176 jurisdictions. Two controls connect when the same duties, in at least 2 laws we track, reach both. The connections are our own reading of the law; no framework publisher has reviewed or endorsed them.

From: NIST AI Risk Management Framework, version 1.0, January 2023 (NIST AI 100-1), National Institute of Standards and Technology
To: FINOS AI Governance Framework, version 2, as maintained on October 7, 2026, FINOS
See also: FINOS AIGF to NIST AI RMF, the other way · every pair in the crosswalk · law library as of 19 Oct 2026

Download this mapping, with every law behind each connection: nist-ai-rmf--finos-ai-governance-framework.csv · nist-ai-rmf--finos-ai-governance-framework.json

NIST AI RMF	FINOS AIGF	Laws	Jurisdictions	Where the laws stand
GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.	AIR-DET-004AI System Observability	41	22	31 in force, 9 not yet in force, 1 proposed
	The 41 laws behind GOVERN 1.1 and AIR-DET-004 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Companion Chatbot Safety and Accountability Act (SB 243), California Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months HB 26-1263 (2026), Conversational AI Service Operator Requirements, Colorado Lov nr. 467 af 14. maj 2025, National Competent Authorities and Article 5 Enforcement, Denmark Resolución ANIA 0001/2025, registro obligatorio para decisiones consecuenciales, El Salvador AI Act, Article 111(2) (2030 compliance deadline for public-authority-intended systems), European Union from 2 Aug 2030, in 3.8 years AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months AI Act, Article 18 (documentation keeping), European Union from 2 Dec 2027, in 13 months and 31 more, every one in the free file.
	AIR-DET-021Agent Decision Audit and Explainability	41	22	31 in force, 9 not yet in force, 1 proposed
	The 41 laws behind GOVERN 1.1 and AIR-DET-021 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Companion Chatbot Safety and Accountability Act (SB 243), California Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months HB 26-1263 (2026), Conversational AI Service Operator Requirements, Colorado Lov nr. 467 af 14. maj 2025, National Competent Authorities and Article 5 Enforcement, Denmark Resolución ANIA 0001/2025, registro obligatorio para decisiones consecuenciales, El Salvador AI Act, Article 111(2) (2030 compliance deadline for public-authority-intended systems), European Union from 2 Aug 2030, in 3.8 years AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months AI Act, Article 18 (documentation keeping), European Union from 2 Dec 2027, in 13 months and 31 more, every one in the free file.
	AIR-PREV-005System Acceptance Testing	38	20	28 in force, 9 not yet in force, 1 proposed
	The 38 laws behind GOVERN 1.1 and AIR-PREV-005 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months Lov nr. 467 af 14. maj 2025, National Competent Authorities and Article 5 Enforcement, Denmark Resolución ANIA 0001/2025, registro obligatorio para decisiones consecuenciales, El Salvador AI Act, Article 111(2) (2030 compliance deadline for public-authority-intended systems), European Union from 2 Aug 2030, in 3.8 years AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months AI Act, Article 18 (documentation keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 21(2) (competent authority access to automatically generated logs), European Union from 2 Dec 2027, in 13 months AI Act, Article 22(3), points (b) and (c) (authorised representative: documents held for 10 years and access to logs), European Union from 2 Dec 2027, in 13 months and 28 more, every one in the free file.
	AIR-PREV-006Data Quality & Classification/Sensitivity	38	20	28 in force, 9 not yet in force, 1 proposed
	The 38 laws behind GOVERN 1.1 and AIR-PREV-006 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months Lov nr. 467 af 14. maj 2025, National Competent Authorities and Article 5 Enforcement, Denmark Resolución ANIA 0001/2025, registro obligatorio para decisiones consecuenciales, El Salvador AI Act, Article 111(2) (2030 compliance deadline for public-authority-intended systems), European Union from 2 Aug 2030, in 3.8 years AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months AI Act, Article 18 (documentation keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 21(2) (competent authority access to automatically generated logs), European Union from 2 Dec 2027, in 13 months AI Act, Article 22(3), points (b) and (c) (authorised representative: documents held for 10 years and access to logs), European Union from 2 Dec 2027, in 13 months and 28 more, every one in the free file.
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	38	20	28 in force, 9 not yet in force, 1 proposed
	The 38 laws behind GOVERN 1.1 and AIR-PREV-024 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months Lov nr. 467 af 14. maj 2025, National Competent Authorities and Article 5 Enforcement, Denmark Resolución ANIA 0001/2025, registro obligatorio para decisiones consecuenciales, El Salvador AI Act, Article 111(2) (2030 compliance deadline for public-authority-intended systems), European Union from 2 Aug 2030, in 3.8 years AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months AI Act, Article 18 (documentation keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 21(2) (competent authority access to automatically generated logs), European Union from 2 Dec 2027, in 13 months AI Act, Article 22(3), points (b) and (c) (authorised representative: documents held for 10 years and access to logs), European Union from 2 Dec 2027, in 13 months and 28 more, every one in the free file.
	AIR-DET-011Human Feedback Loop for AI Systems	38	20	28 in force, 9 not yet in force, 1 proposed
	The 38 laws behind GOVERN 1.1 and AIR-DET-011 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months Lov nr. 467 af 14. maj 2025, National Competent Authorities and Article 5 Enforcement, Denmark Resolución ANIA 0001/2025, registro obligatorio para decisiones consecuenciales, El Salvador AI Act, Article 111(2) (2030 compliance deadline for public-authority-intended systems), European Union from 2 Aug 2030, in 3.8 years AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months AI Act, Article 18 (documentation keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 21(2) (competent authority access to automatically generated logs), European Union from 2 Dec 2027, in 13 months AI Act, Article 22(3), points (b) and (c) (authorised representative: documents held for 10 years and access to logs), European Union from 2 Dec 2027, in 13 months and 28 more, every one in the free file.
GOVERN 1.4The risk management process and its outcomes are established through transparent...	AIR-PREV-005System Acceptance Testing	17	12	11 in force, 6 not yet in force
	The 17 laws behind GOVERN 1.4 and AIR-PREV-005 Transparency in Frontier Artificial Intelligence Act (SB 53), California OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado AI Act, Article 17 (quality management system), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months AI Act, Article 9 (risk management system), European Union from 2 Dec 2027, in 13 months EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan and 7 more, every one in the free file.
	AIR-PREV-006Data Quality & Classification/Sensitivity	17	12	11 in force, 6 not yet in force
	The 17 laws behind GOVERN 1.4 and AIR-PREV-006 Transparency in Frontier Artificial Intelligence Act (SB 53), California OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado AI Act, Article 17 (quality management system), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months AI Act, Article 9 (risk management system), European Union from 2 Dec 2027, in 13 months EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan and 7 more, every one in the free file.
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	17	12	11 in force, 6 not yet in force
	The 17 laws behind GOVERN 1.4 and AIR-PREV-024 Transparency in Frontier Artificial Intelligence Act (SB 53), California OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado AI Act, Article 17 (quality management system), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months AI Act, Article 9 (risk management system), European Union from 2 Dec 2027, in 13 months EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan and 7 more, every one in the free file.
	AIR-DET-004AI System Observability	17	12	11 in force, 6 not yet in force
	The 17 laws behind GOVERN 1.4 and AIR-DET-004 Transparency in Frontier Artificial Intelligence Act (SB 53), California OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado AI Act, Article 17 (quality management system), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months AI Act, Article 9 (risk management system), European Union from 2 Dec 2027, in 13 months EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan and 7 more, every one in the free file.
	AIR-DET-011Human Feedback Loop for AI Systems	17	12	11 in force, 6 not yet in force
	The 17 laws behind GOVERN 1.4 and AIR-DET-011 Transparency in Frontier Artificial Intelligence Act (SB 53), California OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado AI Act, Article 17 (quality management system), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months AI Act, Article 9 (risk management system), European Union from 2 Dec 2027, in 13 months EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan and 7 more, every one in the free file.
	AIR-DET-021Agent Decision Audit and Explainability	17	12	11 in force, 6 not yet in force
	The 17 laws behind GOVERN 1.4 and AIR-DET-021 Transparency in Frontier Artificial Intelligence Act (SB 53), California OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado AI Act, Article 17 (quality management system), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months AI Act, Article 9 (risk management system), European Union from 2 Dec 2027, in 13 months EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan and 7 more, every one in the free file.
GOVERN 1.6Mechanisms are in place to inventory AI systems and are resourced according to...	AIR-PREV-005System Acceptance Testing	7	6	6 in force, 1 not yet in force
	The 7 laws behind GOVERN 1.6 and AIR-PREV-005 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom Interagency Supervisory Guidance on Model Risk Management (2026 revision), United States
	AIR-PREV-006Data Quality & Classification/Sensitivity	7	6	6 in force, 1 not yet in force
	The 7 laws behind GOVERN 1.6 and AIR-PREV-006 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom Interagency Supervisory Guidance on Model Risk Management (2026 revision), United States
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	7	6	6 in force, 1 not yet in force
	The 7 laws behind GOVERN 1.6 and AIR-PREV-024 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom Interagency Supervisory Guidance on Model Risk Management (2026 revision), United States
	AIR-DET-004AI System Observability	7	6	6 in force, 1 not yet in force
	The 7 laws behind GOVERN 1.6 and AIR-DET-004 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom Interagency Supervisory Guidance on Model Risk Management (2026 revision), United States
	AIR-DET-011Human Feedback Loop for AI Systems	7	6	6 in force, 1 not yet in force
	The 7 laws behind GOVERN 1.6 and AIR-DET-011 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom Interagency Supervisory Guidance on Model Risk Management (2026 revision), United States
	AIR-DET-021Agent Decision Audit and Explainability	7	6	6 in force, 1 not yet in force
	The 7 laws behind GOVERN 1.6 and AIR-DET-021 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom Interagency Supervisory Guidance on Model Risk Management (2026 revision), United States
GOVERN 2.1Roles and responsibilities and lines of communication related to mapping, measuring,...	AIR-PREV-005System Acceptance Testing	7	6	7 in force
	The 7 laws behind GOVERN 2.1 and AIR-PREV-005 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union MiFID II Suitability Assessment for Investment Advice and Portfolio Management, Including Automated and Semi-Automated Systems (Article 25(2) and Delegated Regulation 2017/565 Article 54), European Union Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Suitability for MiFID business: personal recommendations and decisions to trade, including advice given through an automated or semi-automated system, United Kingdom Interagency Supervisory Guidance on Model Risk Management (2026 revision), United States
	AIR-PREV-006Data Quality & Classification/Sensitivity	7	6	7 in force
	The 7 laws behind GOVERN 2.1 and AIR-PREV-006 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union MiFID II Suitability Assessment for Investment Advice and Portfolio Management, Including Automated and Semi-Automated Systems (Article 25(2) and Delegated Regulation 2017/565 Article 54), European Union Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Suitability for MiFID business: personal recommendations and decisions to trade, including advice given through an automated or semi-automated system, United Kingdom Interagency Supervisory Guidance on Model Risk Management (2026 revision), United States
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	7	6	7 in force
	The 7 laws behind GOVERN 2.1 and AIR-PREV-024 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union MiFID II Suitability Assessment for Investment Advice and Portfolio Management, Including Automated and Semi-Automated Systems (Article 25(2) and Delegated Regulation 2017/565 Article 54), European Union Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Suitability for MiFID business: personal recommendations and decisions to trade, including advice given through an automated or semi-automated system, United Kingdom Interagency Supervisory Guidance on Model Risk Management (2026 revision), United States
	AIR-DET-004AI System Observability	7	6	7 in force
	The 7 laws behind GOVERN 2.1 and AIR-DET-004 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union MiFID II Suitability Assessment for Investment Advice and Portfolio Management, Including Automated and Semi-Automated Systems (Article 25(2) and Delegated Regulation 2017/565 Article 54), European Union Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Suitability for MiFID business: personal recommendations and decisions to trade, including advice given through an automated or semi-automated system, United Kingdom Interagency Supervisory Guidance on Model Risk Management (2026 revision), United States
	AIR-DET-011Human Feedback Loop for AI Systems	7	6	7 in force
	The 7 laws behind GOVERN 2.1 and AIR-DET-011 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union MiFID II Suitability Assessment for Investment Advice and Portfolio Management, Including Automated and Semi-Automated Systems (Article 25(2) and Delegated Regulation 2017/565 Article 54), European Union Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Suitability for MiFID business: personal recommendations and decisions to trade, including advice given through an automated or semi-automated system, United Kingdom Interagency Supervisory Guidance on Model Risk Management (2026 revision), United States
	AIR-DET-021Agent Decision Audit and Explainability	7	6	7 in force
	The 7 laws behind GOVERN 2.1 and AIR-DET-021 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union MiFID II Suitability Assessment for Investment Advice and Portfolio Management, Including Automated and Semi-Automated Systems (Article 25(2) and Delegated Regulation 2017/565 Article 54), European Union Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Suitability for MiFID business: personal recommendations and decisions to trade, including advice given through an automated or semi-automated system, United Kingdom Interagency Supervisory Guidance on Model Risk Management (2026 revision), United States
GOVERN 2.3Executive leadership of the organization takes responsibility for decisions about...	AIR-PREV-005System Acceptance Testing	4	4	4 in force
	The 4 laws behind GOVERN 2.3 and AIR-PREV-005 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
	AIR-PREV-006Data Quality & Classification/Sensitivity	4	4	4 in force
	The 4 laws behind GOVERN 2.3 and AIR-PREV-006 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	4	4	4 in force
	The 4 laws behind GOVERN 2.3 and AIR-PREV-024 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
	AIR-DET-004AI System Observability	4	4	4 in force
	The 4 laws behind GOVERN 2.3 and AIR-DET-004 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
	AIR-DET-011Human Feedback Loop for AI Systems	4	4	4 in force
	The 4 laws behind GOVERN 2.3 and AIR-DET-011 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
	AIR-DET-021Agent Decision Audit and Explainability	4	4	4 in force
	The 4 laws behind GOVERN 2.3 and AIR-DET-021 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
GOVERN 4.2Organizational teams document the risks and potential impacts of the AI technology...	AIR-DET-021Agent Decision Audit and Explainability	10	7	6 in force, 3 not yet in force, 1 proposed
	The 10 laws behind GOVERN 4.2 and AIR-DET-021 Employment Technological Displacement Notice (SB 951), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California Digital Services Act, Article 37 (independent audit of very large online platforms and search engines), European Union Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Artificial Intelligence Video Interview Act, Illinois Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months S.B. 1090, SAFECHAT Act, Pennsylvania proposed AI Framework Act, Article 32 (safety-assurance duty for high-compute AI systems), South Korea AI Framework Act, Article 34 (business-operator duties for high-impact AI), South Korea
	AIR-DET-004AI System Observability	8	6	5 in force, 3 not yet in force
	The 8 laws behind GOVERN 4.2 and AIR-DET-004 Employment Technological Displacement Notice (SB 951), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California Digital Services Act, Article 37 (independent audit of very large online platforms and search engines), European Union Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Artificial Intelligence Video Interview Act, Illinois Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months AI Framework Act, Article 32 (safety-assurance duty for high-compute AI systems), South Korea
	AIR-PREV-005System Acceptance Testing	2	2	2 in force
	The 2 laws behind GOVERN 4.2 and AIR-PREV-005 Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan
GOVERN 4.3Organizational practices are in place to enable AI testing, identification of...	AIR-DET-004AI System Observability	2	2	1 in force, 1 not yet in force
	The 2 laws behind GOVERN 4.3 and AIR-DET-004 Transparency in Frontier Artificial Intelligence Act (SB 53), California Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months
	AIR-DET-021Agent Decision Audit and Explainability	2	2	1 in force, 1 not yet in force
	The 2 laws behind GOVERN 4.3 and AIR-DET-021 Transparency in Frontier Artificial Intelligence Act (SB 53), California Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months
GOVERN 6.1Policies and procedures are in place that address AI risks associated with third-party...	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	2	2	1 in force, 1 not yet in force
	The 2 laws behind GOVERN 6.1 and AIR-PREV-007 AI Act, Article 25 (responsibilities along the AI value chain), European Union from 2 Dec 2027, in 13 months Reform to the Federal Labor Law and the Federal Copyright Law, AI Voice and Image Consent Regime for Performing Artists, Mexico
MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are...	AIR-DET-021Agent Decision Audit and Explainability	4	4	3 in force, 1 not yet in force
	The 4 laws behind MAP 1.6 and AIR-DET-021 Companion Chatbot Safety and Accountability Act (SB 243), California Artificial Intelligence Video Interview Act, Illinois Use of artificial intelligence in therapy or psychotherapy services, Maine AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months
MAP 2.2Information about the AI system’s knowledge limits and how system output may be...	AIR-DET-021Agent Decision Audit and Explainability	5	4	1 in force, 4 not yet in force
	The 5 laws behind MAP 2.2 and AIR-DET-021 Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Transparency in Frontier Artificial Intelligence Act (SB 53), California AI Act, Article 13 (transparency and provision of information to deployers), European Union from 2 Dec 2027, in 13 months Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Federal Law No. 243-FZ, Article 8, Duties of Sovereign and National Foundation Model Developers, Russia from 1 Mar 2027, in 4 months
MAP 2.3Scientific integrity and TEVV considerations are identified and documented, including...	AIR-PREV-005System Acceptance Testing	12	9	8 in force, 4 not yet in force
	The 12 laws behind MAP 2.3 and AIR-PREV-005 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months AI Act, Article 53 (obligations for providers of general-purpose AI models), European Union Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Counter-Fraud Framework: fraud detection systems, machine learning and artificial intelligence, Saudi Arabia Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom and 2 more, every one in the free file.
	AIR-PREV-006Data Quality & Classification/Sensitivity	12	9	8 in force, 4 not yet in force
	The 12 laws behind MAP 2.3 and AIR-PREV-006 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months AI Act, Article 53 (obligations for providers of general-purpose AI models), European Union Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Counter-Fraud Framework: fraud detection systems, machine learning and artificial intelligence, Saudi Arabia Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom and 2 more, every one in the free file.
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	12	9	8 in force, 4 not yet in force
	The 12 laws behind MAP 2.3 and AIR-PREV-024 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months AI Act, Article 53 (obligations for providers of general-purpose AI models), European Union Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Counter-Fraud Framework: fraud detection systems, machine learning and artificial intelligence, Saudi Arabia Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom and 2 more, every one in the free file.
	AIR-DET-004AI System Observability	12	9	8 in force, 4 not yet in force
	The 12 laws behind MAP 2.3 and AIR-DET-004 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months AI Act, Article 53 (obligations for providers of general-purpose AI models), European Union Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Counter-Fraud Framework: fraud detection systems, machine learning and artificial intelligence, Saudi Arabia Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom and 2 more, every one in the free file.
	AIR-DET-011Human Feedback Loop for AI Systems	12	9	8 in force, 4 not yet in force
	The 12 laws behind MAP 2.3 and AIR-DET-011 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months AI Act, Article 53 (obligations for providers of general-purpose AI models), European Union Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Counter-Fraud Framework: fraud detection systems, machine learning and artificial intelligence, Saudi Arabia Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom and 2 more, every one in the free file.
	AIR-DET-021Agent Decision Audit and Explainability	12	9	8 in force, 4 not yet in force
	The 12 laws behind MAP 2.3 and AIR-DET-021 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months AI Act, Article 53 (obligations for providers of general-purpose AI models), European Union Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Counter-Fraud Framework: fraud detection systems, machine learning and artificial intelligence, Saudi Arabia Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom and 2 more, every one in the free file.
MAP 3.3Targeted application scope is specified and documented based on the system’s...	AIR-PREV-005System Acceptance Testing	148	88	127 in force, 17 not yet in force, 1 blocked by a court, 3 proposed
	The 148 laws behind MAP 3.3 and AIR-PREV-005 Alabama Child Protection Act of 2024, AI-Generated Child Sexual Abuse Material, Alabama AI-generated and indistinguishable depictions included in child-exploitation definitions (HB 2678), Arizona Unlawful disclosure extended to AI-generated 'realistic pictorial representation' intimate images (SB 1462), Arizona Act 159 of 2025 (HB 1071), AI-Generated Replicas Amendment to Publicity Rights Act, Arkansas Act 827 of 2025 (HB 1529), Unlawful Creation or Distribution of Deepfake Visual Material, Arkansas Act 977 of 2025 (HB 1877), AI-Generated Child Sexual Abuse Material Amendments, Arkansas Using a Carriage Service to Transmit Sexual Material Without Consent (Deepfake Offences), Australia StGB Section 207a(4)(4), Computer-Generated and Altered Child Sexual Abuse Material, Austria Sexual Offences Act, child pornography offence, Bahamas Cyber Security Act, 2026, AI-generated sexual content and CSAM ban, Bangladesh and 138 more, every one in the free file.
	AIR-DET-021Agent Decision Audit and Explainability	5	4	4 in force, 1 not yet in force
	The 5 laws behind MAP 3.3 and AIR-DET-021 Attorney, Court Filing and Arbitrator Generative AI Duties (SB 574), California from 1 Jan 2027, in 2 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Law on Artificial Intelligence, risk classification and conformity assessment, Vietnam
	AIR-PREV-006Data Quality & Classification/Sensitivity	4	3	3 in force, 1 not yet in force
	The 4 laws behind MAP 3.3 and AIR-PREV-006 Platform Work Directive, Ban on One-to-Many Biometric Identification of Persons Performing Platform Work (Article 7(1)(f)), European Union from 2 Dec 2026, in 6 weeks Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Law on Artificial Intelligence, risk classification and conformity assessment, Vietnam
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	3	2	3 in force
	The 3 laws behind MAP 3.3 and AIR-PREV-024 Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Law on Artificial Intelligence, risk classification and conformity assessment, Vietnam
	AIR-DET-004AI System Observability	3	2	3 in force
	The 3 laws behind MAP 3.3 and AIR-DET-004 Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Law on Artificial Intelligence, risk classification and conformity assessment, Vietnam
	AIR-DET-011Human Feedback Loop for AI Systems	3	2	3 in force
	The 3 laws behind MAP 3.3 and AIR-DET-011 Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Law on Artificial Intelligence, risk classification and conformity assessment, Vietnam
MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with...	AIR-DET-021Agent Decision Audit and Explainability	29	22	21 in force, 8 not yet in force
	The 29 laws behind MAP 3.5 and AIR-DET-021 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Practice Direction No. 18 of 2025, ethical use of generative AI in court proceedings, Belize Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union and 19 more, every one in the free file.
	AIR-PREV-006Data Quality & Classification/Sensitivity	28	21	20 in force, 8 not yet in force
	The 28 laws behind MAP 3.5 and AIR-PREV-006 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Law No. 025/2023, automated decisions and profiling, Gabon and 18 more, every one in the free file.
	AIR-PREV-005System Acceptance Testing	26	19	18 in force, 8 not yet in force
	The 26 laws behind MAP 3.5 and AIR-PREV-005 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Private Review Agent Artificial Intelligence Coverage Determinations Act (SB 444), Georgia from 1 Jan 2027, in 2 months and 16 more, every one in the free file.
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	25	18	17 in force, 8 not yet in force
	The 25 laws behind MAP 3.5 and AIR-PREV-024 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Private Review Agent Artificial Intelligence Coverage Determinations Act (SB 444), Georgia from 1 Jan 2027, in 2 months and 15 more, every one in the free file.
	AIR-DET-004AI System Observability	25	18	17 in force, 8 not yet in force
	The 25 laws behind MAP 3.5 and AIR-DET-004 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Private Review Agent Artificial Intelligence Coverage Determinations Act (SB 444), Georgia from 1 Jan 2027, in 2 months and 15 more, every one in the free file.
	AIR-DET-011Human Feedback Loop for AI Systems	25	18	17 in force, 8 not yet in force
	The 25 laws behind MAP 3.5 and AIR-DET-011 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Private Review Agent Artificial Intelligence Coverage Determinations Act (SB 444), Georgia from 1 Jan 2027, in 2 months and 15 more, every one in the free file.
MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the...	AIR-PREV-018Agent Authority Least Privilege Framework	145	107	142 in force, 3 not yet in force
	The 145 laws behind MAP 4.1 and AIR-PREV-018 Penal Code, Part Twelve, Chapter One (Cyber Crimes and Punishment), Afghanistan Alabama Digital Crime Act, Computer Tampering, Alabama Criminal mischief in the fourth degree, unauthorized computer access, Alaska Criminal use of a computer, Alaska Theft of services, unauthorized use of a computer system, Alaska Copyright Law, Sui Generis Database Producers Rights, Albania Criminal Code, Unauthorized Computer Access, Albania Code pénal, atteintes aux systèmes de traitement automatisé de données, Algeria Ordonnance n° 03-05, exception de citation, Algeria Ordonnance n° 03-05, protection des bases de données, Algeria and 135 more, every one in the free file.
	AIR-PREV-023Agentic System Credential Protection Framework	145	107	142 in force, 3 not yet in force
	The 145 laws behind MAP 4.1 and AIR-PREV-023 Penal Code, Part Twelve, Chapter One (Cyber Crimes and Punishment), Afghanistan Alabama Digital Crime Act, Computer Tampering, Alabama Criminal mischief in the fourth degree, unauthorized computer access, Alaska Criminal use of a computer, Alaska Theft of services, unauthorized use of a computer system, Alaska Copyright Law, Sui Generis Database Producers Rights, Albania Criminal Code, Unauthorized Computer Access, Albania Code pénal, atteintes aux systèmes de traitement automatisé de données, Algeria Ordonnance n° 03-05, exception de citation, Algeria Ordonnance n° 03-05, protection des bases de données, Algeria and 135 more, every one in the free file.
	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	51	39	50 in force, 1 not yet in force
	The 51 laws behind MAP 4.1 and AIR-PREV-007 Ordonnance n° 03-05, exception de citation, Algeria Copyright and Neighboring Rights Law, Press and Current-Events Reproduction Exception, Andorra Copyright Act 1998, compilation and database protection, Bahamas Copyright Act 1998, fair dealing for reporting current events and criticism, Bahamas Code de droit économique, article XI.190, 20°, exception de fouille de textes et de données, Belgium Copyright and Designs Act 2004, fair dealing for criticism, review and reporting current events, Bermuda Law on Copyright and Related Rights, Content Limitations (No Text-and-Data-Mining Exception), Bosnia and Herzegovina Copyright and Neighbouring Rights Act (ZAPSP), Arts. 26e, 26zh and 26k, Text-and-Data-Mining Exception for Crawling and Training, Bulgaria Copyright and Neighbouring Rights Act (ZAPSP), Arts. 90d and 90zh, Press Publisher Right, Bulgaria Loi n°048-2019/AN du 12 novembre 2019 portant protection de la propriété littéraire et artistique, database and news exceptions, Burkina Faso and 41 more, every one in the free file.
	AIR-DET-013Providing Citations and Source Traceability for AI-Generated Information	33	28	33 in force
	The 33 laws behind MAP 4.1 and AIR-DET-013 Ordonnance n° 03-05, exception de citation, Algeria Copyright and Neighboring Rights Law, Press and Current-Events Reproduction Exception, Andorra Copyright Act 1998, compilation and database protection, Bahamas Copyright Act 1998, fair dealing for reporting current events and criticism, Bahamas Copyright and Designs Act 2004, fair dealing for criticism, review and reporting current events, Bermuda Copyright and Neighbouring Rights Act (ZAPSP), Arts. 90d and 90zh, Press Publisher Right, Bulgaria Loi n°048-2019/AN du 12 novembre 2019 portant protection de la propriété littéraire et artistique, database and news exceptions, Burkina Faso Law No. 1/021 of December 30, 2005 on the Protection of Copyright and Related Rights, database and facts exclusions, Burundi Copyright (Cayman Islands) Order 2015, database and compilation copyright, Cayman Islands Law on Literary and Artistic Property, quotation and press-review exception, Comoros and 23 more, every one in the free file.
	AIR-PREV-005System Acceptance Testing	3	3	2 in force, 1 not yet in force
	The 3 laws behind MAP 4.1 and AIR-PREV-005 AB 1159 (2026), student personal information (KOPIPA, ELPIPA and the Higher Education Student Information Protection Act), California from 1 Jan 2027, in 2 months Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Cyber and Data Protection Act [Chapter 12:07], Zimbabwe
	AIR-PREV-006Data Quality & Classification/Sensitivity	2	2	2 in force
	The 2 laws behind MAP 4.1 and AIR-PREV-006 Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Cyber and Data Protection Act [Chapter 12:07], Zimbabwe
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	2	2	2 in force
	The 2 laws behind MAP 4.1 and AIR-PREV-024 Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Cyber and Data Protection Act [Chapter 12:07], Zimbabwe
	AIR-DET-004AI System Observability	2	2	2 in force
	The 2 laws behind MAP 4.1 and AIR-DET-004 Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Cyber and Data Protection Act [Chapter 12:07], Zimbabwe
	AIR-DET-011Human Feedback Loop for AI Systems	2	2	2 in force
	The 2 laws behind MAP 4.1 and AIR-DET-011 Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Cyber and Data Protection Act [Chapter 12:07], Zimbabwe
	AIR-DET-021Agent Decision Audit and Explainability	2	2	2 in force
	The 2 laws behind MAP 4.1 and AIR-DET-021 Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Cyber and Data Protection Act [Chapter 12:07], Zimbabwe
MAP 5.1Likelihood and magnitude of each identified impact (both potentially beneficial and...	AIR-PREV-005System Acceptance Testing	14	13	8 in force, 1 not yet in force, 5 proposed
	The 14 laws behind MAP 5.1 and AIR-PREV-005 Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Canada, Canada proposed Superintendencia Circular on AI and Personal Data, Colombia SPDP Norma General guaranteeing personal-data protection in the use of AI systems, Ecuador AI Act, Article 27 (fundamental rights impact assessment), European Union from 2 Dec 2027, in 13 months Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany DPC Guidance: AI, Large Language Models and Data Protection, Ireland Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy and 4 more, every one in the free file.
	AIR-PREV-006Data Quality & Classification/Sensitivity	3	3	3 in force
	The 3 laws behind MAP 5.1 and AIR-PREV-006 Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	3	3	3 in force
	The 3 laws behind MAP 5.1 and AIR-PREV-024 Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
	AIR-DET-004AI System Observability	3	3	3 in force
	The 3 laws behind MAP 5.1 and AIR-DET-004 Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
	AIR-DET-011Human Feedback Loop for AI Systems	3	3	3 in force
	The 3 laws behind MAP 5.1 and AIR-DET-011 Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
	AIR-DET-021Agent Decision Audit and Explainability	3	3	3 in force
	The 3 laws behind MAP 5.1 and AIR-DET-021 Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
MEASURE 2.4The functionality and behavior of the AI system and its components – as identified in...	AIR-PREV-005System Acceptance Testing	23	12	13 in force, 10 not yet in force
	The 23 laws behind MEASURE 2.4 and AIR-PREV-005 Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months SPDP Norma General guaranteeing personal-data protection in the use of AI systems, Ecuador AI Act, Article 12 (record-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 19 (automatically generated logs), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(6) (deployer log-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months and 13 more, every one in the free file.
	AIR-PREV-006Data Quality & Classification/Sensitivity	23	12	13 in force, 10 not yet in force
	The 23 laws behind MEASURE 2.4 and AIR-PREV-006 Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months SPDP Norma General guaranteeing personal-data protection in the use of AI systems, Ecuador AI Act, Article 12 (record-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 19 (automatically generated logs), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(6) (deployer log-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months and 13 more, every one in the free file.
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	23	12	13 in force, 10 not yet in force
	The 23 laws behind MEASURE 2.4 and AIR-PREV-024 Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months SPDP Norma General guaranteeing personal-data protection in the use of AI systems, Ecuador AI Act, Article 12 (record-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 19 (automatically generated logs), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(6) (deployer log-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months and 13 more, every one in the free file.
	AIR-DET-004AI System Observability	23	12	13 in force, 10 not yet in force
	The 23 laws behind MEASURE 2.4 and AIR-DET-004 Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months SPDP Norma General guaranteeing personal-data protection in the use of AI systems, Ecuador AI Act, Article 12 (record-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 19 (automatically generated logs), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(6) (deployer log-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months and 13 more, every one in the free file.
	AIR-DET-011Human Feedback Loop for AI Systems	23	12	13 in force, 10 not yet in force
	The 23 laws behind MEASURE 2.4 and AIR-DET-011 Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months SPDP Norma General guaranteeing personal-data protection in the use of AI systems, Ecuador AI Act, Article 12 (record-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 19 (automatically generated logs), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(6) (deployer log-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months and 13 more, every one in the free file.
	AIR-DET-021Agent Decision Audit and Explainability	23	12	13 in force, 10 not yet in force
	The 23 laws behind MEASURE 2.4 and AIR-DET-021 Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months SPDP Norma General guaranteeing personal-data protection in the use of AI systems, Ecuador AI Act, Article 12 (record-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 19 (automatically generated logs), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(6) (deployer log-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months and 13 more, every one in the free file.
MEASURE 2.5The AI system to be deployed is demonstrated to be valid and reliable. Limitations of...	AIR-DET-021Agent Decision Audit and Explainability	2	2	2 in force
	The 2 laws behind MEASURE 2.5 and AIR-DET-021 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Interagency Supervisory Guidance on Model Risk Management (2026 revision), United States
	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	2	1	1 in force, 1 not yet in force
	The 2 laws behind MEASURE 2.5 and AIR-PREV-007 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
	AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems	2	1	1 in force, 1 not yet in force
	The 2 laws behind MEASURE 2.5 and AIR-PREV-008 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
	AIR-PREV-012Role-Based Access Control for AI Data	2	1	1 in force, 1 not yet in force
	The 2 laws behind MEASURE 2.5 and AIR-PREV-012 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
	AIR-PREV-014Encryption of AI Data at Rest	2	1	1 in force, 1 not yet in force
	The 2 laws behind MEASURE 2.5 and AIR-PREV-014 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
	AIR-PREV-017AI Firewall Implementation and Management	2	1	1 in force, 1 not yet in force
	The 2 laws behind MEASURE 2.5 and AIR-PREV-017 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
	AIR-PREV-020MCP Server Security Governance	2	1	1 in force, 1 not yet in force
	The 2 laws behind MEASURE 2.5 and AIR-PREV-020 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
	AIR-DET-001AI Data Leakage Prevention and Detection	2	1	1 in force, 1 not yet in force
	The 2 laws behind MEASURE 2.5 and AIR-DET-001 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
MEASURE 2.6The AI system is evaluated regularly for safety risks – as identified in the MAP...	AIR-DET-021Agent Decision Audit and Explainability	3	3	1 in force, 1 not yet in force, 1 proposed
	The 3 laws behind MEASURE 2.6 and AIR-DET-021 Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months S.B. 1090, SAFECHAT Act, Pennsylvania proposed
	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	3	2	2 in force, 1 not yet in force
	The 3 laws behind MEASURE 2.6 and AIR-PREV-007 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems	3	2	2 in force, 1 not yet in force
	The 3 laws behind MEASURE 2.6 and AIR-PREV-008 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-PREV-012Role-Based Access Control for AI Data	3	2	2 in force, 1 not yet in force
	The 3 laws behind MEASURE 2.6 and AIR-PREV-012 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-PREV-014Encryption of AI Data at Rest	3	2	2 in force, 1 not yet in force
	The 3 laws behind MEASURE 2.6 and AIR-PREV-014 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-PREV-017AI Firewall Implementation and Management	3	2	2 in force, 1 not yet in force
	The 3 laws behind MEASURE 2.6 and AIR-PREV-017 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-PREV-020MCP Server Security Governance	3	2	2 in force, 1 not yet in force
	The 3 laws behind MEASURE 2.6 and AIR-PREV-020 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-DET-001AI Data Leakage Prevention and Detection	3	2	2 in force, 1 not yet in force
	The 3 laws behind MEASURE 2.6 and AIR-DET-001 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	AIR-DET-004AI System Observability	2	2	1 in force, 1 not yet in force
	The 2 laws behind MEASURE 2.6 and AIR-DET-004 Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy AI Companion Chatbot Safety Act (SB 1546), Oregon from 1 Jan 2027, in 2 months
MEASURE 2.7AI system security and resilience – as identified in the MAP function – are evaluated...	AIR-PREV-007Legal and Contractual Frameworks for AI Systems	3	2	2 in force, 1 not yet in force
	The 3 laws behind MEASURE 2.7 and AIR-PREV-007 Superintendencia Circular on AI and Personal Data, Colombia AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
	AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems	3	2	2 in force, 1 not yet in force
	The 3 laws behind MEASURE 2.7 and AIR-PREV-008 Superintendencia Circular on AI and Personal Data, Colombia AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
	AIR-PREV-012Role-Based Access Control for AI Data	3	2	2 in force, 1 not yet in force
	The 3 laws behind MEASURE 2.7 and AIR-PREV-012 Superintendencia Circular on AI and Personal Data, Colombia AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
	AIR-PREV-014Encryption of AI Data at Rest	3	2	2 in force, 1 not yet in force
	The 3 laws behind MEASURE 2.7 and AIR-PREV-014 Superintendencia Circular on AI and Personal Data, Colombia AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
	AIR-PREV-017AI Firewall Implementation and Management	3	2	2 in force, 1 not yet in force
	The 3 laws behind MEASURE 2.7 and AIR-PREV-017 Superintendencia Circular on AI and Personal Data, Colombia AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
	AIR-PREV-020MCP Server Security Governance	3	2	2 in force, 1 not yet in force
	The 3 laws behind MEASURE 2.7 and AIR-PREV-020 Superintendencia Circular on AI and Personal Data, Colombia AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
	AIR-DET-001AI Data Leakage Prevention and Detection	3	2	2 in force, 1 not yet in force
	The 3 laws behind MEASURE 2.7 and AIR-DET-001 Superintendencia Circular on AI and Personal Data, Colombia AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
	AIR-PREV-005System Acceptance Testing	2	2	1 in force, 1 not yet in force
	The 2 laws behind MEASURE 2.7 and AIR-PREV-005 Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Federal Law No. 243-FZ, Article 8, Duties of Sovereign and National Foundation Model Developers, Russia from 1 Mar 2027, in 4 months
	AIR-PREV-006Data Quality & Classification/Sensitivity	2	2	1 in force, 1 not yet in force
	The 2 laws behind MEASURE 2.7 and AIR-PREV-006 Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Federal Law No. 243-FZ, Article 8, Duties of Sovereign and National Foundation Model Developers, Russia from 1 Mar 2027, in 4 months
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	2	2	1 in force, 1 not yet in force
	The 2 laws behind MEASURE 2.7 and AIR-PREV-024 Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Federal Law No. 243-FZ, Article 8, Duties of Sovereign and National Foundation Model Developers, Russia from 1 Mar 2027, in 4 months
	AIR-DET-004AI System Observability	2	2	1 in force, 1 not yet in force
	The 2 laws behind MEASURE 2.7 and AIR-DET-004 Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Federal Law No. 243-FZ, Article 8, Duties of Sovereign and National Foundation Model Developers, Russia from 1 Mar 2027, in 4 months
	AIR-DET-011Human Feedback Loop for AI Systems	2	2	1 in force, 1 not yet in force
	The 2 laws behind MEASURE 2.7 and AIR-DET-011 Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Federal Law No. 243-FZ, Article 8, Duties of Sovereign and National Foundation Model Developers, Russia from 1 Mar 2027, in 4 months
	AIR-DET-021Agent Decision Audit and Explainability	2	2	1 in force, 1 not yet in force
	The 2 laws behind MEASURE 2.7 and AIR-DET-021 Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Federal Law No. 243-FZ, Article 8, Duties of Sovereign and National Foundation Model Developers, Russia from 1 Mar 2027, in 4 months
MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP...	AIR-DET-021Agent Decision Audit and Explainability	66	43	41 in force, 13 not yet in force, 12 proposed
	The 66 laws behind MEASURE 2.8 and AIR-DET-021 Distribution of Materially Deceptive Media to Influence an Upcoming Election, Alabama SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Practice Direction No. 18 of 2025, ethical use of generative AI in court proceedings, Belize Attorney, Court Filing and Arbitrator Generative AI Duties (SB 574), California from 1 Jan 2027, in 2 months California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), California CCPA Automated Decisionmaking Technology Regulations, California Companion Chatbot Safety and Accountability Act (SB 243), California Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months and 56 more, every one in the free file.
	AIR-PREV-005System Acceptance Testing	2	2	1 in force, 1 not yet in force
	The 2 laws behind MEASURE 2.8 and AIR-PREV-005 Attorney, Court Filing and Arbitrator Generative AI Duties (SB 574), California from 1 Jan 2027, in 2 months Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica
	AIR-PREV-006Data Quality & Classification/Sensitivity	2	2	1 in force, 1 not yet in force
	The 2 laws behind MEASURE 2.8 and AIR-PREV-006 Consumer Credit Act, Articles 24 and 30, Personalised Offers and Creditworthiness Assessment by Automated Processing, Croatia from 20 Nov 2026, in 4 weeks Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica
MEASURE 2.9The AI model is explained, validated, and documented, and AI system output is...	AIR-DET-021Agent Decision Audit and Explainability	17	14	10 in force, 6 not yet in force, 1 proposed
	The 17 laws behind MEASURE 2.9 and AIR-DET-021 Personal Data Protection Law, automated decisions, Burkina Faso CCPA Automated Decisionmaking Technology Regulations, California Loi n° 24.001 portant protection des données à caractère personnel, droits liés au traitement, Central African Republic Consumer Credit Act, Articles 24 and 30, Personalised Offers and Creditworthiness Assessment by Automated Processing, Croatia from 20 Nov 2026, in 4 weeks AI Act, Article 86 (right to explanation of individual decision-making), European Union from 2 Dec 2027, in 13 months Consumer Credit Directive, Right to Human Intervention in an Automated Creditworthiness Assessment (Article 18(8)), European Union from 20 Nov 2026, in 4 weeks GDPR Article 22, Automated Individual Decision-Making, European Union Platform Work Directive, Transparency, Human Oversight and Human Review of Automated Systems (Articles 9 to 11), European Union from 2 Dec 2026, in 6 weeks Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan and 7 more, every one in the free file.
	AIR-PREV-006Data Quality & Classification/Sensitivity	11	11	7 in force, 4 not yet in force
	The 11 laws behind MEASURE 2.9 and AIR-PREV-006 CCPA Automated Decisionmaking Technology Regulations, California Loi n° 24.001 portant protection des données à caractère personnel, droits liés au traitement, Central African Republic Consumer Credit Act, Articles 24 and 30, Personalised Offers and Creditworthiness Assessment by Automated Processing, Croatia from 20 Nov 2026, in 4 weeks AI Act, Article 86 (right to explanation of individual decision-making), European Union from 2 Dec 2027, in 13 months Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Loi n° 2022-59, droits des personnes concernées, Niger Ley N° 7593/2025, automated or semi-automated individual decisions, Paraguay from 27 Nov 2027, in 13 months Consumer Credit Act (2026:1011), Chapter 2 Section 7 and Chapter 3 Section 15, Personalised Offers and Credit Assessment by Automated Processing, Sweden from 20 Nov 2026, in 4 weeks Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates and 1 more, every one in the free file.
	AIR-PREV-005System Acceptance Testing	5	5	5 in force
	The 5 laws behind MEASURE 2.9 and AIR-PREV-005 Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Loi n° 2022-59, droits des personnes concernées, Niger Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	4	4	4 in force
	The 4 laws behind MEASURE 2.9 and AIR-PREV-024 Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom
	AIR-DET-004AI System Observability	4	4	4 in force
	The 4 laws behind MEASURE 2.9 and AIR-DET-004 Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom
	AIR-DET-011Human Feedback Loop for AI Systems	4	4	4 in force
	The 4 laws behind MEASURE 2.9 and AIR-DET-011 Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom
MEASURE 2.10Privacy risk of the AI system – as identified in the MAP function – is examined and documented.	AIR-PREV-005System Acceptance Testing	6	6	4 in force, 2 not yet in force
	The 6 laws behind MEASURE 2.10 and AIR-PREV-005 Superintendencia Circular on AI and Personal Data, Colombia HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months Ley de Fomento a la Inteligencia Artificial y Tecnologías, marco institucional, registro y evaluación de riesgos, El Salvador AI Act, Article 26(9) (using Article 13 information for a data protection impact assessment), European Union from 2 Dec 2027, in 13 months Act XLVII of 1997 on Health Data, Section 35/A(4) to (8), Conditions for AI Development on Electronic Health Service Space Data, Hungary FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius
	AIR-PREV-006Data Quality & Classification/Sensitivity	2	2	1 in force, 1 not yet in force
	The 2 laws behind MEASURE 2.10 and AIR-PREV-006 Loi n° 24.001 portant protection des données à caractère personnel, collecte de données publiquement accessibles et transfert transfrontalier, Central African Republic HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months
	AIR-DET-021Agent Decision Audit and Explainability	2	2	1 in force, 1 not yet in force
	The 2 laws behind MEASURE 2.10 and AIR-DET-021 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months
MEASURE 2.11Fairness and bias – as identified in the MAP function – are evaluated and results are...	AIR-PREV-005System Acceptance Testing	6	5	4 in force, 2 not yet in force
	The 6 laws behind MEASURE 2.11 and AIR-PREV-005 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
	AIR-PREV-006Data Quality & Classification/Sensitivity	6	5	4 in force, 2 not yet in force
	The 6 laws behind MEASURE 2.11 and AIR-PREV-006 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	6	5	4 in force, 2 not yet in force
	The 6 laws behind MEASURE 2.11 and AIR-PREV-024 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
	AIR-DET-004AI System Observability	6	5	4 in force, 2 not yet in force
	The 6 laws behind MEASURE 2.11 and AIR-DET-004 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
	AIR-DET-011Human Feedback Loop for AI Systems	6	5	4 in force, 2 not yet in force
	The 6 laws behind MEASURE 2.11 and AIR-DET-011 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
	AIR-DET-021Agent Decision Audit and Explainability	6	5	4 in force, 2 not yet in force
	The 6 laws behind MEASURE 2.11 and AIR-DET-021 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
MEASURE 3.3Feedback processes for end users and impacted communities to report problems and...	AIR-DET-021Agent Decision Audit and Explainability	21	21	10 in force, 4 not yet in force, 7 proposed
	The 21 laws behind MEASURE 3.3 and AIR-DET-021 Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Data Protection Act, 2019, automated decisions, Barbados Anteproyecto de Ley de Protección de Datos Personales (AGETIC), Bolivia proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Canada, Canada proposed Consumer Credit Act, Articles 24 and 30, Personalised Offers and Creditworthiness Assessment by Automated Processing, Croatia from 20 Nov 2026, in 4 weeks Consumer Credit Directive, Right to Human Intervention in an Automated Creditworthiness Assessment (Article 18(8)), European Union from 20 Nov 2026, in 4 weeks Law No. 025/2023, automated decisions and profiling, Gabon Council of Europe Framework Convention on AI, Georgia's signature, Georgia proposed Data Protection Act, 2012, automated decision-taking, Ghana and 11 more, every one in the free file.
	AIR-PREV-006Data Quality & Classification/Sensitivity	12	12	8 in force, 3 not yet in force, 1 proposed
	The 12 laws behind MEASURE 3.3 and AIR-PREV-006 Data Protection Act, 2019, automated decisions, Barbados Anteproyecto de Ley de Protección de Datos Personales (AGETIC), Bolivia proposed Consumer Credit Act, Articles 24 and 30, Personalised Offers and Creditworthiness Assessment by Automated Processing, Croatia from 20 Nov 2026, in 4 weeks Law No. 025/2023, automated decisions and profiling, Gabon Data Protection Act, 2012, automated decision-taking, Ghana GDPR Article 22 and Data Protection Act 2018 Section 57, Automated Decision-Making in Ireland, Ireland Law No. 81/2018, Part V, notice, objection, access and correction, Lebanon FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Ley Federal de Protección de Datos Personales en Posesión de los Particulares, automated decisions, Mexico Ley N° 7593/2025, automated or semi-automated individual decisions, Paraguay from 27 Nov 2027, in 13 months and 2 more, every one in the free file.
	AIR-DET-004AI System Observability	3	3	3 in force
	The 3 laws behind MEASURE 3.3 and AIR-DET-004 Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
	AIR-PREV-005System Acceptance Testing	2	2	2 in force
	The 2 laws behind MEASURE 3.3 and AIR-PREV-005 FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	2	2	2 in force
	The 2 laws behind MEASURE 3.3 and AIR-PREV-024 FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
	AIR-DET-011Human Feedback Loop for AI Systems	2	2	2 in force
	The 2 laws behind MEASURE 3.3 and AIR-DET-011 FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
MANAGE 1.3Responses to the AI risks deemed high priority, as identified by the MAP function, are...	AIR-PREV-005System Acceptance Testing	8	8	2 in force, 1 not yet in force, 5 proposed
	The 8 laws behind MANAGE 1.3 and AIR-PREV-005 Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months Council of Europe Framework Convention on Artificial Intelligence, signed by Canada, Canada proposed Superintendencia Circular on AI and Personal Data, Colombia Commission Guidelines on prohibited AI practices under the AI Act (C(2025) 5052 final), European Union Council of Europe Framework Convention on Artificial Intelligence, signed by Moldova, Moldova proposed Council of Europe Framework Convention on Artificial Intelligence, signed by the United Kingdom, United Kingdom proposed
MANAGE 2.4Mechanisms are in place and applied, and responsibilities are assigned and understood,...	AIR-DET-021Agent Decision Audit and Explainability	6	5	5 in force, 1 not yet in force
	The 6 laws behind MANAGE 2.4 and AIR-DET-021 AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model Management Standards: governance, validation and monitoring of the models a bank uses to decide, including artificial intelligence models, United Arab Emirates
	AIR-DET-004AI System Observability	5	4	4 in force, 1 not yet in force
	The 5 laws behind MANAGE 2.4 and AIR-DET-004 AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model Management Standards: governance, validation and monitoring of the models a bank uses to decide, including artificial intelligence models, United Arab Emirates
	AIR-PREV-005System Acceptance Testing	4	3	4 in force
	The 4 laws behind MANAGE 2.4 and AIR-PREV-005 Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model Management Standards: governance, validation and monitoring of the models a bank uses to decide, including artificial intelligence models, United Arab Emirates
	AIR-PREV-006Data Quality & Classification/Sensitivity	4	3	4 in force
	The 4 laws behind MANAGE 2.4 and AIR-PREV-006 Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model Management Standards: governance, validation and monitoring of the models a bank uses to decide, including artificial intelligence models, United Arab Emirates
	AIR-PREV-024Human-in-the-Loop Action Approval Gate	4	3	4 in force
	The 4 laws behind MANAGE 2.4 and AIR-PREV-024 Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model Management Standards: governance, validation and monitoring of the models a bank uses to decide, including artificial intelligence models, United Arab Emirates
	AIR-DET-011Human Feedback Loop for AI Systems	4	3	4 in force
	The 4 laws behind MANAGE 2.4 and AIR-DET-011 Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model Management Standards: governance, validation and monitoring of the models a bank uses to decide, including artificial intelligence models, United Arab Emirates
MANAGE 4.1Post-deployment AI system monitoring plans are implemented, including mechanisms for...	AIR-DET-004AI System Observability	7	6	6 in force, 1 not yet in force
	The 7 laws behind MANAGE 4.1 and AIR-DET-004 Loi n° 09-04 relative à la prévention et à la lutte contre les infractions liées aux technologies de l'information et de la communication, Algeria AI Act, Article 17 (quality management system), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Artificial Intelligence Video Interview Act, Illinois Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Code Pénal Arts. 294-3 to 294-4, Child Sexual Abuse Material Including Realistic and AI-Generated Depictions, Monaco Law on Artificial Intelligence, incident management and reporting obligation, Vietnam
	AIR-DET-021Agent Decision Audit and Explainability	7	6	6 in force, 1 not yet in force
	The 7 laws behind MANAGE 4.1 and AIR-DET-021 Loi n° 09-04 relative à la prévention et à la lutte contre les infractions liées aux technologies de l'information et de la communication, Algeria CCPA Automated Decisionmaking Technology Regulations, California AI Act, Article 17 (quality management system), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Artificial Intelligence Video Interview Act, Illinois Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Code Pénal Arts. 294-3 to 294-4, Child Sexual Abuse Material Including Realistic and AI-Generated Depictions, Monaco
	AIR-PREV-006Data Quality & Classification/Sensitivity	2	2	1 in force, 1 not yet in force
	The 2 laws behind MANAGE 4.1 and AIR-PREV-006 CCPA Automated Decisionmaking Technology Regulations, California AI Act, Article 17 (quality management system), European Union from 2 Dec 2027, in 13 months
MANAGE 4.3Incidents and errors are communicated to relevant AI actors, including affected...	AIR-DET-004AI System Observability	9	7	5 in force, 3 not yet in force, 1 proposed
	The 9 laws behind MANAGE 4.3 and AIR-DET-004 Transparency in Frontier Artificial Intelligence Act (SB 53), California AI Act, Article 20 (corrective actions and duty of information), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan AI Framework Act, Article 32 (safety-assurance duty for high-compute AI systems), South Korea Artificial Intelligence Risk Management and Security Act of 2026, United States proposed Law on Artificial Intelligence, incident management and reporting obligation, Vietnam
	AIR-DET-021Agent Decision Audit and Explainability	8	6	4 in force, 3 not yet in force, 1 proposed
	The 8 laws behind MANAGE 4.3 and AIR-DET-021 Transparency in Frontier Artificial Intelligence Act (SB 53), California AI Act, Article 20 (corrective actions and duty of information), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan AI Framework Act, Article 32 (safety-assurance duty for high-compute AI systems), South Korea Artificial Intelligence Risk Management and Security Act of 2026, United States proposed

Not connected to the FINOS AIGF: 44 of NIST AI RMF's controls

Short of 2 laws

The same duties reach these and a FINOS AIGF control, in fewer than 2 of the laws we track.

GOVERN 1.3 Processes, procedures, and practices are in place to determine the needed level of...: with AIR-PREV-005, AIR-PREV-006, AIR-PREV-024, AIR-DET-004, AIR-DET-011 and AIR-DET-021 through Model risk management principles for banks, United Kingdom
GOVERN 1.5 Ongoing monitoring and periodic review of the risk management process and its outcomes...: with AIR-PREV-005, AIR-PREV-006, AIR-PREV-024, AIR-DET-004, AIR-DET-011 and AIR-DET-021 through Transparency in Frontier Artificial Intelligence Act (SB 53), California
GOVERN 3.2 Policies and procedures are in place to define and differentiate roles and...: with AIR-PREV-005, AIR-PREV-006, AIR-PREV-024, AIR-DET-004, AIR-DET-011 and AIR-DET-021 through Platform Work Directive, Transparency, Human Oversight and Human Review of Automated Systems (Articles 9 to 11), European Union
GOVERN 4.1 Organizational policies and practices are in place to foster a critical thinking and...: with AIR-DET-004 and AIR-DET-021 through Transparency in Frontier Artificial Intelligence Act (SB 53), California
MAP 1.1 Intended purposes, potentially beneficial uses, context-specific laws, norms and...: with AIR-PREV-005 through AI Act, Article 27 (fundamental rights impact assessment), European Union
MAP 3.4 Processes for operator and practitioner proficiency with AI system performance and...: with AIR-PREV-005, AIR-PREV-006, AIR-PREV-024, AIR-DET-004, AIR-DET-011 and AIR-DET-021 through Decreto Legislativo 160/2026, Police Use of AI Systems: Human Review, Oversight, Collaborations, Sandbox Basis and Training (Artt. 3-6, 21), Italy
MEASURE 2.1 Test sets, metrics, and details about the tools used during TEVV are documented.: with AIR-PREV-005, AIR-PREV-006, AIR-PREV-024, AIR-DET-004, AIR-DET-011 and AIR-DET-021 through AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union
MANAGE 1.1 A determination is made as to whether the AI system achieves its intended purposes and...: with AIR-PREV-005, AIR-PREV-006, AIR-PREV-024, AIR-DET-004, AIR-DET-011 and AIR-DET-021 through AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union; with AIR-PREV-007, AIR-PREV-008, AIR-PREV-012, AIR-PREV-014, AIR-PREV-017, AIR-PREV-020 and AIR-DET-001 through MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
MANAGE 2.3 Procedures are followed to respond to and recover from a previously unknown risk when...: with AIR-DET-004 and AIR-DET-021 through AI Act, Article 20 (corrective actions and duty of information), European Union

No FINOS AIGF control on the same duties

Laws reach these, but no duty that reaches one of them also reaches a FINOS AIGF control.

GOVERN 1.2 The characteristics of trustworthy AI are integrated into organizational policies,..., 6 laws
GOVERN 1.7 Processes and procedures are in place for decommissioning and phasing out AI systems..., 1 law
GOVERN 2.2 The organization’s personnel and partners receive AI risk management training to..., 3 laws
GOVERN 5.1 Organizational policies and practices are in place to collect, consider, prioritize,..., 1 law
GOVERN 6.2 Contingency processes are in place to handle failures or incidents in third-party data..., 1 law
MAP 1.5 Organizational risk tolerances are determined and documented., 1 law
MEASURE 1.2 Appropriateness of AI metrics and effectiveness of existing controls are regularly..., 1 law
MEASURE 1.3 Internal experts who did not serve as front-line developers for the system and/or..., 10 laws
MEASURE 2.2 Evaluations involving human subjects meet applicable requirements (including human..., 1 law
MEASURE 2.3 AI system performance or assurance criteria are measured qualitatively or..., 6 laws
MEASURE 3.1 Approaches, personnel, and documentation are in place to regularly identify and track..., 2 laws
MANAGE 2.1 Resources required to manage AI risks are taken into account – along with viable..., 1 law
MANAGE 3.1 AI risks and benefits from third-party resources are regularly monitored, and risk..., 3 laws

No law we track reaches these

No duty in the laws we track reaches these controls.

GOVERN 3.1 Decision-making related to mapping, measuring, and managing AI risks throughout the...
GOVERN 5.2 Mechanisms are established to enable the team that developed or deployed AI systems to...
MAP 1.2 Interdisciplinary AI actors, competencies, skills, and capacities for establishing...
MAP 1.3 The organization’s mission and relevant goals for AI technology are understood and documented.
MAP 1.4 The business value or context of business use has been clearly defined or – in the...
MAP 2.1 The specific tasks and methods used to implement the tasks that the AI system will...
MAP 3.1 Potential benefits of intended AI system functionality and performance are examined...
MAP 3.2 Potential costs, including non-monetary costs, which result from expected or realized...
MAP 4.2 Internal risk controls for components of the AI system, including third-party AI...
MAP 5.2 Practices and personnel for supporting regular engagement with relevant AI actors and...
MEASURE 1.1 Approaches and metrics for measurement of AI risks enumerated during the MAP function...
MEASURE 2.12 Environmental impact and sustainability of AI model training and management activities...
MEASURE 2.13 Effectiveness of the employed TEVV metrics and processes in the MEASURE function are...
MEASURE 3.2 Risk tracking approaches are considered for settings where AI risks are difficult to...
MEASURE 4.1 Measurement approaches for identifying AI risks are connected to deployment context(s)...
MEASURE 4.2 Measurement results regarding AI system trustworthiness in deployment context(s) and...
MEASURE 4.3 Measurable performance improvements or declines based on consultations with relevant...
MANAGE 1.2 Treatment of documented AI risks is prioritized based on impact, likelihood, and...
MANAGE 1.4 Negative residual risks (defined as the sum of all unmitigated risks) to both...
MANAGE 2.2 Mechanisms are in place and applied to sustain the value of deployed AI systems.
MANAGE 3.2 Pre-trained models which are used for development are monitored as part of AI system...
MANAGE 4.2 Measurable activities for continual improvements are integrated into AI system updates...

Lines of the communications, age assurance and cybersecurity laws we track were not read against the NIST AI RMF, so none of them connects the two here (how each subject's lines were read).

How these connections are drawn

Each requirement line in the laws we track is read against the framework for its subject (the AI, scraping and news aggregation laws against the NIST AI RMF, the privacy, communications and age assurance laws against the NIST Privacy Framework, the cybersecurity laws against the NIST CSF 2.0); laws on liability and content moderation are not read against any framework yet. A line reaches the FINOS AIGF through a kind of duty its law carries, and only where that kind of duty also reaches, on that same line, the NIST framework for the line's own subject. Two controls connect when lines in at least 2 laws reach both. That says the same duties reach both; it does not say the two are alike, or that running either one does what a law asks.

A line placed on a control in the framework for its own subject, whose law carries a kind of duty that reaches another of the three frameworks read line by line, is read against that one as well: every such line, or only those whose wording reaches into it. For these two:

Laws on	Read against the NIST AI RMF
privacy	such lines on automated decisions, profiling and AI
communications	not read
age assurance	not read
cybersecurity	not read

Every duty line in the AI, scraping, news aggregation and privacy laws we track has been read against the framework for its subject.

The NIST AI Risk Management Framework, mapped to the FINOS AI Governance Framework

Short of 2 laws

No FINOS AIGF control on the same duties

No law we track reaches these

How these connections are drawn

Sources and licenses