Law / Frameworks / Crosswalk / NIST AI RMF to NIST AI 200-2

The NIST AI Risk Management Framework, mapped to the NIST TEVV-Athlon Framework for Evaluating AI Systems

20 of NIST AI RMF's controls connect to 4 of NIST AI 200-2's through 88 laws in 40 jurisdictions. Two controls connect when the same duties, in at least 2 laws we track, reach both. The connections are our own reading of the law; no framework publisher has reviewed or endorsed them.

From: NIST AI Risk Management Framework, version 1.0, January 2023 (NIST AI 100-1), National Institute of Standards and Technology
To: NIST TEVV-Athlon Framework for Evaluating AI Systems, initial public draft, August 2026 (NIST AI 200-2 ipd), National Institute of Standards and Technology
See also: NIST AI 200-2 to NIST AI RMF, the other way · every pair in the crosswalk · law library as of 19 Oct 2026

Download this mapping, with every law behind each connection: nist-ai-rmf--nist-ai-200-2.csv · nist-ai-rmf--nist-ai-200-2.json

NIST AI RMF	NIST AI 200-2	Laws	Jurisdictions	Where the laws stand
GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.	2.3Apply & Measure	38	20	28 in force, 9 not yet in force, 1 proposed
	The 38 laws behind GOVERN 1.1 and 2.3 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months Lov nr. 467 af 14. maj 2025, National Competent Authorities and Article 5 Enforcement, Denmark Resolución ANIA 0001/2025, registro obligatorio para decisiones consecuenciales, El Salvador AI Act, Article 111(2) (2030 compliance deadline for public-authority-intended systems), European Union from 2 Aug 2030, in 3.8 years AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months AI Act, Article 18 (documentation keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 21(2) (competent authority access to automatically generated logs), European Union from 2 Dec 2027, in 13 months AI Act, Article 22(3), points (b) and (c) (authorised representative: documents held for 10 years and access to logs), European Union from 2 Dec 2027, in 13 months and 28 more, every one in the free file.
	4.3Composing a TEVV Toolbox	38	20	28 in force, 9 not yet in force, 1 proposed
	The 38 laws behind GOVERN 1.1 and 4.3 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months Lov nr. 467 af 14. maj 2025, National Competent Authorities and Article 5 Enforcement, Denmark Resolución ANIA 0001/2025, registro obligatorio para decisiones consecuenciales, El Salvador AI Act, Article 111(2) (2030 compliance deadline for public-authority-intended systems), European Union from 2 Aug 2030, in 3.8 years AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months AI Act, Article 18 (documentation keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 21(2) (competent authority access to automatically generated logs), European Union from 2 Dec 2027, in 13 months AI Act, Article 22(3), points (b) and (c) (authorised representative: documents held for 10 years and access to logs), European Union from 2 Dec 2027, in 13 months and 28 more, every one in the free file.
GOVERN 1.4The risk management process and its outcomes are established through transparent...	2.3Apply & Measure	17	12	11 in force, 6 not yet in force
	The 17 laws behind GOVERN 1.4 and 2.3 Transparency in Frontier Artificial Intelligence Act (SB 53), California OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado AI Act, Article 17 (quality management system), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months AI Act, Article 9 (risk management system), European Union from 2 Dec 2027, in 13 months EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan and 7 more, every one in the free file.
	4.3Composing a TEVV Toolbox	17	12	11 in force, 6 not yet in force
	The 17 laws behind GOVERN 1.4 and 4.3 Transparency in Frontier Artificial Intelligence Act (SB 53), California OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado AI Act, Article 17 (quality management system), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months AI Act, Article 9 (risk management system), European Union from 2 Dec 2027, in 13 months EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Artificial Intelligence Safety Measures Act, Illinois from 1 Jan 2027, in 2 months Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan and 7 more, every one in the free file.
GOVERN 1.6Mechanisms are in place to inventory AI systems and are resourced according to...	2.3Apply & Measure	7	6	6 in force, 1 not yet in force
	The 7 laws behind GOVERN 1.6 and 2.3 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom Interagency Supervisory Guidance on Model Risk Management (2026 revision), United States
	4.3Composing a TEVV Toolbox	7	6	6 in force, 1 not yet in force
	The 7 laws behind GOVERN 1.6 and 4.3 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021, Mauritius Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom Interagency Supervisory Guidance on Model Risk Management (2026 revision), United States
GOVERN 2.1Roles and responsibilities and lines of communication related to mapping, measuring,...	2.3Apply & Measure	7	6	7 in force
	The 7 laws behind GOVERN 2.1 and 2.3 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union MiFID II Suitability Assessment for Investment Advice and Portfolio Management, Including Automated and Semi-Automated Systems (Article 25(2) and Delegated Regulation 2017/565 Article 54), European Union Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Suitability for MiFID business: personal recommendations and decisions to trade, including advice given through an automated or semi-automated system, United Kingdom Interagency Supervisory Guidance on Model Risk Management (2026 revision), United States
	4.3Composing a TEVV Toolbox	7	6	7 in force
	The 7 laws behind GOVERN 2.1 and 4.3 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union MiFID II Suitability Assessment for Investment Advice and Portfolio Management, Including Automated and Semi-Automated Systems (Article 25(2) and Delegated Regulation 2017/565 Article 54), European Union Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Suitability for MiFID business: personal recommendations and decisions to trade, including advice given through an automated or semi-automated system, United Kingdom Interagency Supervisory Guidance on Model Risk Management (2026 revision), United States
GOVERN 2.3Executive leadership of the organization takes responsibility for decisions about...	2.3Apply & Measure	4	4	4 in force
	The 4 laws behind GOVERN 2.3 and 2.3 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
	4.3Composing a TEVV Toolbox	4	4	4 in force
	The 4 laws behind GOVERN 2.3 and 4.3 OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017), Canada EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers, Michigan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
MAP 2.3Scientific integrity and TEVV considerations are identified and documented, including...	2.3Apply & Measure	12	9	8 in force, 4 not yet in force
	The 12 laws behind MAP 2.3 and 2.3 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months AI Act, Article 53 (obligations for providers of general-purpose AI models), European Union Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Counter-Fraud Framework: fraud detection systems, machine learning and artificial intelligence, Saudi Arabia Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom and 2 more, every one in the free file.
	4.3Composing a TEVV Toolbox	12	9	8 in force, 4 not yet in force
	The 12 laws behind MAP 2.3 and 4.3 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months AI Act, Article 53 (obligations for providers of general-purpose AI models), European Union Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union Counter-Fraud Framework: fraud detection systems, machine learning and artificial intelligence, Saudi Arabia Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom and 2 more, every one in the free file.
MAP 3.3Targeted application scope is specified and documented based on the system’s...	4.3Composing a TEVV Toolbox	4	3	4 in force
	The 4 laws behind MAP 3.3 and 4.3 MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Law on Artificial Intelligence, risk classification and conformity assessment, Vietnam
	2.3Apply & Measure	3	2	3 in force
	The 3 laws behind MAP 3.3 and 2.3 Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Law on Artificial Intelligence, risk classification and conformity assessment, Vietnam
MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with...	2.3Apply & Measure	25	18	17 in force, 8 not yet in force
	The 25 laws behind MAP 3.5 and 2.3 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Private Review Agent Artificial Intelligence Coverage Determinations Act (SB 444), Georgia from 1 Jan 2027, in 2 months and 15 more, every one in the free file.
	4.3Composing a TEVV Toolbox	25	18	17 in force, 8 not yet in force
	The 25 laws behind MAP 3.5 and 4.3 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Employment Automated Decision Systems Act (SB 947), California from 1 Jul 2027, in 8 months Health Care Services Artificial Intelligence Act (AB 1979), California from 1 Jan 2027, in 2 months CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice, Canada HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 14 (human oversight), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance, European Union Private Review Agent Artificial Intelligence Coverage Determinations Act (SB 444), Georgia from 1 Jan 2027, in 2 months and 15 more, every one in the free file.
MAP 5.1Likelihood and magnitude of each identified impact (both potentially beneficial and...	2.4Synthesize & Interrogate	9	8	3 in force, 1 not yet in force, 5 proposed
	The 9 laws behind MAP 5.1 and 2.4 Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Canada, Canada proposed AI Act, Article 27 (fundamental rights impact assessment), European Union from 2 Dec 2027, in 13 months Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13), Italy Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan Council of Europe Framework Convention on Artificial Intelligence, signed by Moldova, Moldova proposed Council of Europe Framework Convention on Artificial Intelligence, signed by the United Kingdom, United Kingdom proposed
	2.3Apply & Measure	3	3	3 in force
	The 3 laws behind MAP 5.1 and 2.3 Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
	4.3Composing a TEVV Toolbox	3	3	3 in force
	The 3 laws behind MAP 5.1 and 4.3 Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan
MEASURE 2.4The functionality and behavior of the AI system and its components – as identified in...	2.3Apply & Measure	22	11	12 in force, 10 not yet in force
	The 22 laws behind MEASURE 2.4 and 2.3 Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 12 (record-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 19 (automatically generated logs), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(6) (deployer log-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months AI Act, Article 72 (post-market monitoring by providers and post-market monitoring plan), European Union from 2 Dec 2027, in 13 months and 12 more, every one in the free file.
	4.3Composing a TEVV Toolbox	22	11	12 in force, 10 not yet in force
	The 22 laws behind MEASURE 2.4 and 4.3 Clinical Decision Support Systems Bias Mitigation Act (SB 503), California from 1 Jan 2027, in 2 months OSFI Guideline E-23, Model Risk Management (2027), Canada from 1 May 2027, in 6 months HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 12 (record-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 19 (automatically generated logs), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(10) (post-remote biometric identification authorisation), European Union from 2 Dec 2027, in 13 months AI Act, Article 26(6) (deployer log-keeping), European Union from 2 Dec 2027, in 13 months AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties), European Union from 2 Dec 2027, in 13 months AI Act, Article 72 (post-market monitoring by providers and post-market monitoring plan), European Union from 2 Dec 2027, in 13 months and 12 more, every one in the free file.
MEASURE 2.5The AI system to be deployed is demonstrated to be valid and reliable. Limitations of...	4.3Composing a TEVV Toolbox	3	2	2 in force, 1 not yet in force
	The 3 laws behind MEASURE 2.5 and 4.3 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Interagency Supervisory Guidance on Model Risk Management (2026 revision), United States
	2.2Define & Construct	2	1	1 in force, 1 not yet in force
	The 2 laws behind MEASURE 2.5 and 2.2 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
MEASURE 2.6The AI system is evaluated regularly for safety risks – as identified in the MAP...	2.2Define & Construct	3	2	2 in force, 1 not yet in force
	The 3 laws behind MEASURE 2.6 and 2.2 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
	4.3Composing a TEVV Toolbox	3	2	2 in force, 1 not yet in force
	The 3 laws behind MEASURE 2.6 and 4.3 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Italy
MEASURE 2.7AI system security and resilience – as identified in the MAP function – are evaluated...	4.3Composing a TEVV Toolbox	4	3	2 in force, 2 not yet in force
	The 4 laws behind MEASURE 2.7 and 4.3 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Federal Law No. 243-FZ, Article 8, Duties of Sovereign and National Foundation Model Developers, Russia from 1 Mar 2027, in 4 months
	2.3Apply & Measure	2	2	1 in force, 1 not yet in force
	The 2 laws behind MEASURE 2.7 and 2.3 Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), Italy Federal Law No. 243-FZ, Article 8, Duties of Sovereign and National Foundation Model Developers, Russia from 1 Mar 2027, in 4 months
	2.2Define & Construct	2	1	1 in force, 1 not yet in force
	The 2 laws behind MEASURE 2.7 and 2.2 AI Act, Article 15 (accuracy, robustness and cybersecurity), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
MEASURE 2.9The AI model is explained, validated, and documented, and AI system output is...	2.3Apply & Measure	4	4	4 in force
	The 4 laws behind MEASURE 2.9 and 2.3 Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom
	4.3Composing a TEVV Toolbox	4	4	4 in force
	The 4 laws behind MEASURE 2.9 and 4.3 Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Germany FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model risk management principles for banks, United Kingdom
MEASURE 2.10Privacy risk of the AI system – as identified in the MAP function – is examined and documented.	2.4Synthesize & Interrogate	4	4	3 in force, 1 not yet in force
	The 4 laws behind MEASURE 2.10 and 2.4 Ley de Fomento a la Inteligencia Artificial y Tecnologías, marco institucional, registro y evaluación de riesgos, El Salvador AI Act, Article 26(9) (using Article 13 information for a data protection impact assessment), European Union from 2 Dec 2027, in 13 months Act XLVII of 1997 on Health Data, Section 35/A(4) to (8), Conditions for AI Development on Electronic Health Service Space Data, Hungary FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius
MEASURE 2.11Fairness and bias – as identified in the MAP function – are evaluated and results are...	2.3Apply & Measure	6	5	4 in force, 2 not yet in force
	The 6 laws behind MEASURE 2.11 and 2.3 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
	4.3Composing a TEVV Toolbox	6	5	4 in force, 2 not yet in force
	The 6 laws behind MEASURE 2.11 and 4.3 SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization, Alabama Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, Colorado HB 26-1139 (2026), Use of Artificial Intelligence in Health Care, Colorado from 1 Jan 2027, in 2 months AI Act, Article 10 (data and data governance), European Union from 2 Dec 2027, in 13 months Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
MEASURE 3.3Feedback processes for end users and impacted communities to report problems and...	2.3Apply & Measure	2	2	2 in force
	The 2 laws behind MEASURE 3.3 and 2.3 FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
	4.3Composing a TEVV Toolbox	2	2	2 in force
	The 2 laws behind MEASURE 3.3 and 4.3 FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, Mauritius Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates
MANAGE 1.1A determination is made as to whether the AI system achieves its intended purposes and...	4.3Composing a TEVV Toolbox	2	1	1 in force, 1 not yet in force
	The 2 laws behind MANAGE 1.1 and 4.3 AI Act, Article 16 (obligations of providers of high-risk AI systems), European Union from 2 Dec 2027, in 13 months MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), European Union
MANAGE 1.3Responses to the AI risks deemed high priority, as identified by the MAP function, are...	2.4Synthesize & Interrogate	5	5	5 proposed
	The 5 laws behind MANAGE 1.3 and 2.4 Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra, Andorra proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia, Armenia proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Canada, Canada proposed Council of Europe Framework Convention on Artificial Intelligence, signed by Moldova, Moldova proposed Council of Europe Framework Convention on Artificial Intelligence, signed by the United Kingdom, United Kingdom proposed
MANAGE 2.4Mechanisms are in place and applied, and responsibilities are assigned and understood,...	2.3Apply & Measure	4	3	4 in force
	The 4 laws behind MANAGE 2.4 and 2.3 Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model Management Standards: governance, validation and monitoring of the models a bank uses to decide, including artificial intelligence models, United Arab Emirates
	4.3Composing a TEVV Toolbox	4	3	4 in force
	The 4 laws behind MANAGE 2.4 and 4.3 Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., United Arab Emirates Model Management Standards: governance, validation and monitoring of the models a bank uses to decide, including artificial intelligence models, United Arab Emirates

Not connected to the NIST AI 200-2: 52 of NIST AI RMF's controls

Short of 2 laws

The same duties reach these and a NIST AI 200-2 step, in fewer than 2 of the laws we track.

GOVERN 1.3 Processes, procedures, and practices are in place to determine the needed level of...: with 2.3 and 4.3 through Model risk management principles for banks, United Kingdom
GOVERN 1.5 Ongoing monitoring and periodic review of the risk management process and its outcomes...: with 2.3 and 4.3 through Transparency in Frontier Artificial Intelligence Act (SB 53), California
GOVERN 4.2 Organizational teams document the risks and potential impacts of the AI technology...: with 2.3 and 4.3 through Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, Jordan; with 2.4 through Digital Code, Chapter 23: AI system design and risk-management obligations, Kyrgyzstan
MAP 1.1 Intended purposes, potentially beneficial uses, context-specific laws, norms and...: with 2.4 through AI Act, Article 27 (fundamental rights impact assessment), European Union
MAP 1.6 System requirements (e.g., “the system shall respect the privacy of its users”) are...: with 2.3 and 4.3 through Use of artificial intelligence in therapy or psychotherapy services, Maine
MAP 2.2 Information about the AI system’s knowledge limits and how system output may be...: with 2.3 and 4.3 through Federal Law No. 243-FZ, Article 8, Duties of Sovereign and National Foundation Model Developers, Russia
MAP 3.4 Processes for operator and practitioner proficiency with AI system performance and...: with 2.3 and 4.3 through Decreto Legislativo 160/2026, Police Use of AI Systems: Human Review, Oversight, Collaborations, Sandbox Basis and Training (Artt. 3-6, 21), Italy
MAP 4.1 Approaches for mapping AI technology and legal risks of its components – including the...: with 2.3 and 4.3 through Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act, European Union
MEASURE 2.1 Test sets, metrics, and details about the tools used during TEVV are documented.: with 2.3 and 4.3 through AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent), European Union
MEASURE 2.8 Risks associated with transparency and accountability – as identified in the MAP...: with 2.3 and 4.3 through Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings, Jamaica
MANAGE 4.1 Post-deployment AI system monitoring plans are implemented, including mechanisms for...: with 2.3 and 4.3 through AI Act, Article 17 (quality management system), European Union

No NIST AI 200-2 step on the same duties

Laws reach these, but no duty that reaches one of them also reaches a NIST AI 200-2 step.

GOVERN 1.2 The characteristics of trustworthy AI are integrated into organizational policies,..., 6 laws
GOVERN 1.7 Processes and procedures are in place for decommissioning and phasing out AI systems..., 1 law
GOVERN 2.2 The organization’s personnel and partners receive AI risk management training to..., 3 laws
GOVERN 3.2 Policies and procedures are in place to define and differentiate roles and..., 5 laws
GOVERN 4.1 Organizational policies and practices are in place to foster a critical thinking and..., 3 laws
GOVERN 4.3 Organizational practices are in place to enable AI testing, identification of..., 3 laws
GOVERN 5.1 Organizational policies and practices are in place to collect, consider, prioritize,..., 1 law
GOVERN 6.1 Policies and procedures are in place that address AI risks associated with third-party..., 14 laws
GOVERN 6.2 Contingency processes are in place to handle failures or incidents in third-party data..., 1 law
MAP 1.5 Organizational risk tolerances are determined and documented., 1 law
MEASURE 1.2 Appropriateness of AI metrics and effectiveness of existing controls are regularly..., 1 law
MEASURE 1.3 Internal experts who did not serve as front-line developers for the system and/or..., 10 laws
MEASURE 2.2 Evaluations involving human subjects meet applicable requirements (including human..., 1 law
MEASURE 2.3 AI system performance or assurance criteria are measured qualitatively or..., 6 laws
MEASURE 3.1 Approaches, personnel, and documentation are in place to regularly identify and track..., 2 laws
MANAGE 2.1 Resources required to manage AI risks are taken into account – along with viable..., 1 law
MANAGE 2.3 Procedures are followed to respond to and recover from a previously unknown risk when..., 1 law
MANAGE 3.1 AI risks and benefits from third-party resources are regularly monitored, and risk..., 3 laws
MANAGE 4.3 Incidents and errors are communicated to relevant AI actors, including affected..., 17 laws

No law we track reaches these

No duty in the laws we track reaches these controls.

GOVERN 3.1 Decision-making related to mapping, measuring, and managing AI risks throughout the...
GOVERN 5.2 Mechanisms are established to enable the team that developed or deployed AI systems to...
MAP 1.2 Interdisciplinary AI actors, competencies, skills, and capacities for establishing...
MAP 1.3 The organization’s mission and relevant goals for AI technology are understood and documented.
MAP 1.4 The business value or context of business use has been clearly defined or – in the...
MAP 2.1 The specific tasks and methods used to implement the tasks that the AI system will...
MAP 3.1 Potential benefits of intended AI system functionality and performance are examined...
MAP 3.2 Potential costs, including non-monetary costs, which result from expected or realized...
MAP 4.2 Internal risk controls for components of the AI system, including third-party AI...
MAP 5.2 Practices and personnel for supporting regular engagement with relevant AI actors and...
MEASURE 1.1 Approaches and metrics for measurement of AI risks enumerated during the MAP function...
MEASURE 2.12 Environmental impact and sustainability of AI model training and management activities...
MEASURE 2.13 Effectiveness of the employed TEVV metrics and processes in the MEASURE function are...
MEASURE 3.2 Risk tracking approaches are considered for settings where AI risks are difficult to...
MEASURE 4.1 Measurement approaches for identifying AI risks are connected to deployment context(s)...
MEASURE 4.2 Measurement results regarding AI system trustworthiness in deployment context(s) and...
MEASURE 4.3 Measurable performance improvements or declines based on consultations with relevant...
MANAGE 1.2 Treatment of documented AI risks is prioritized based on impact, likelihood, and...
MANAGE 1.4 Negative residual risks (defined as the sum of all unmitigated risks) to both...
MANAGE 2.2 Mechanisms are in place and applied to sustain the value of deployed AI systems.
MANAGE 3.2 Pre-trained models which are used for development are monitored as part of AI system...
MANAGE 4.2 Measurable activities for continual improvements are integrated into AI system updates...

How these connections are drawn

Each requirement line in the laws we track is read against the framework for its subject (the AI, scraping and news aggregation laws against the NIST AI RMF, the privacy, communications and age assurance laws against the NIST Privacy Framework, the cybersecurity laws against the NIST CSF 2.0); laws on liability and content moderation are not read against any framework yet. A line reaches the NIST AI 200-2 through a kind of duty its law carries, and only where that kind of duty also reaches, on that same line, the NIST framework for the line's own subject. Two controls connect when lines in at least 2 laws reach both. That says the same duties reach both; it does not say the two are alike, or that running either one does what a law asks.

Every duty line in the AI, scraping and news aggregation laws we track has been read against the framework for its subject.