LexLint.ioBeta

Know the law your code answers to.

Law / Frameworks / Crosswalk / NIST Privacy Framework to FINOS AIGF

The NIST Privacy Framework, mapped to the FINOS AI Governance Framework

47 of NIST Privacy Framework's controls connect to 15 of FINOS AIGF's through 1,063 laws in 199 jurisdictions. Two controls connect when the same duties, in at least 2 laws we track, reach both. The connections are our own reading of the law; no framework publisher has reviewed or endorsed them.

From
NIST Privacy Framework, version 1.0, January 2020, National Institute of Standards and Technology
To
FINOS AI Governance Framework, version 2, as maintained on , FINOS
See also
FINOS AIGF to NIST Privacy Framework, the other way · every pair in the crosswalk · law library as of

Download this mapping, with every law behind each connection: nist-privacy-framework--finos-ai-governance-framework.csv · nist-privacy-framework--finos-ai-governance-framework.json

NIST Privacy FrameworkFINOS AIGFLawsJurisdictionsWhere the laws stand
ID.IM-P1Systems/products/services that process data are inventoried. AIR-PREV-005System Acceptance Testing 8 6 7 in force, 1 not yet in force
The 8 laws behind ID.IM-P1 and AIR-PREV-005
AIR-PREV-006Data Quality & Classification/Sensitivity 8 6 7 in force, 1 not yet in force
The 8 laws behind ID.IM-P1 and AIR-PREV-006
AIR-PREV-024Human-in-the-Loop Action Approval Gate 8 6 7 in force, 1 not yet in force
The 8 laws behind ID.IM-P1 and AIR-PREV-024
AIR-DET-004AI System Observability 8 6 7 in force, 1 not yet in force
The 8 laws behind ID.IM-P1 and AIR-DET-004
AIR-DET-011Human Feedback Loop for AI Systems 8 6 7 in force, 1 not yet in force
The 8 laws behind ID.IM-P1 and AIR-DET-011
AIR-DET-021Agent Decision Audit and Explainability 8 6 7 in force, 1 not yet in force
The 8 laws behind ID.IM-P1 and AIR-DET-021
ID.IM-P4Data actions of the systems/products/services are inventoried. AIR-PREV-005System Acceptance Testing 32 31 29 in force, 1 not yet in force, 2 proposed
The 32 laws behind ID.IM-P4 and AIR-PREV-005

and 22 more, every one in the free file.

AIR-PREV-006Data Quality & Classification/Sensitivity 32 31 29 in force, 1 not yet in force, 2 proposed
The 32 laws behind ID.IM-P4 and AIR-PREV-006

and 22 more, every one in the free file.

AIR-PREV-024Human-in-the-Loop Action Approval Gate 32 31 29 in force, 1 not yet in force, 2 proposed
The 32 laws behind ID.IM-P4 and AIR-PREV-024

and 22 more, every one in the free file.

AIR-DET-004AI System Observability 32 31 29 in force, 1 not yet in force, 2 proposed
The 32 laws behind ID.IM-P4 and AIR-DET-004

and 22 more, every one in the free file.

AIR-DET-011Human Feedback Loop for AI Systems 32 31 29 in force, 1 not yet in force, 2 proposed
The 32 laws behind ID.IM-P4 and AIR-DET-011

and 22 more, every one in the free file.

AIR-DET-021Agent Decision Audit and Explainability 32 31 29 in force, 1 not yet in force, 2 proposed
The 32 laws behind ID.IM-P4 and AIR-DET-021

and 22 more, every one in the free file.
ID.IM-P6Data elements within the data actions are inventoried. AIR-PREV-006Data Quality & Classification/Sensitivity 2 2 2 in force
The 2 laws behind ID.IM-P6 and AIR-PREV-006
ID.IM-P7The data processing environment is identified (e.g., geographic location, internal,... AIR-PREV-007Legal and Contractual Frameworks for AI Systems 6 6 6 in force
The 6 laws behind ID.IM-P7 and AIR-PREV-007
ID.RA-P2Data analytic inputs and outputs are identified and evaluated for bias. AIR-PREV-005System Acceptance Testing 3 3 2 in force, 1 not yet in force
The 3 laws behind ID.RA-P2 and AIR-PREV-005
AIR-PREV-006Data Quality & Classification/Sensitivity 3 3 2 in force, 1 not yet in force
The 3 laws behind ID.RA-P2 and AIR-PREV-006
AIR-PREV-024Human-in-the-Loop Action Approval Gate 3 3 2 in force, 1 not yet in force
The 3 laws behind ID.RA-P2 and AIR-PREV-024
AIR-DET-004AI System Observability 3 3 2 in force, 1 not yet in force
The 3 laws behind ID.RA-P2 and AIR-DET-004
AIR-DET-011Human Feedback Loop for AI Systems 3 3 2 in force, 1 not yet in force
The 3 laws behind ID.RA-P2 and AIR-DET-011
AIR-DET-021Agent Decision Audit and Explainability 3 3 2 in force, 1 not yet in force
The 3 laws behind ID.RA-P2 and AIR-DET-021
ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk. AIR-PREV-005System Acceptance Testing 41 37 36 in force, 3 not yet in force, 2 proposed
The 41 laws behind ID.RA-P4 and AIR-PREV-005

and 31 more, every one in the free file.

AIR-PREV-006Data Quality & Classification/Sensitivity 13 13 11 in force, 1 not yet in force, 1 proposed
The 13 laws behind ID.RA-P4 and AIR-PREV-006

and 3 more, every one in the free file.

AIR-PREV-024Human-in-the-Loop Action Approval Gate 13 13 11 in force, 1 not yet in force, 1 proposed
The 13 laws behind ID.RA-P4 and AIR-PREV-024

and 3 more, every one in the free file.

AIR-DET-004AI System Observability 13 13 11 in force, 1 not yet in force, 1 proposed
The 13 laws behind ID.RA-P4 and AIR-DET-004

and 3 more, every one in the free file.

AIR-DET-011Human Feedback Loop for AI Systems 13 13 11 in force, 1 not yet in force, 1 proposed
The 13 laws behind ID.RA-P4 and AIR-DET-011

and 3 more, every one in the free file.

AIR-DET-021Agent Decision Audit and Explainability 13 13 11 in force, 1 not yet in force, 1 proposed
The 13 laws behind ID.RA-P4 and AIR-DET-021

and 3 more, every one in the free file.
ID.RA-P5Risk responses are identified, prioritized, and implemented. AIR-PREV-005System Acceptance Testing 2 2 2 in force
The 2 laws behind ID.RA-P5 and AIR-PREV-005
ID.DE-P2Data processing ecosystem parties (e.g., service providers, customers, partners,... AIR-PREV-007Legal and Contractual Frameworks for AI Systems 14 14 11 in force, 3 not yet in force
The 14 laws behind ID.DE-P2 and AIR-PREV-007

and 4 more, every one in the free file.

AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems 5 5 3 in force, 2 not yet in force
The 5 laws behind ID.DE-P2 and AIR-PREV-008
AIR-PREV-012Role-Based Access Control for AI Data 5 5 3 in force, 2 not yet in force
The 5 laws behind ID.DE-P2 and AIR-PREV-012
AIR-PREV-014Encryption of AI Data at Rest 5 5 3 in force, 2 not yet in force
The 5 laws behind ID.DE-P2 and AIR-PREV-014
AIR-PREV-017AI Firewall Implementation and Management 5 5 3 in force, 2 not yet in force
The 5 laws behind ID.DE-P2 and AIR-PREV-017
AIR-PREV-020MCP Server Security Governance 5 5 3 in force, 2 not yet in force
The 5 laws behind ID.DE-P2 and AIR-PREV-020
AIR-DET-001AI Data Leakage Prevention and Detection 5 5 3 in force, 2 not yet in force
The 5 laws behind ID.DE-P2 and AIR-DET-001
ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate... AIR-PREV-007Legal and Contractual Frameworks for AI Systems 18 15 18 in force
The 18 laws behind ID.DE-P3 and AIR-PREV-007

and 8 more, every one in the free file.

AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems 6 6 6 in force
The 6 laws behind ID.DE-P3 and AIR-PREV-008
AIR-PREV-012Role-Based Access Control for AI Data 6 6 6 in force
The 6 laws behind ID.DE-P3 and AIR-PREV-012
AIR-PREV-014Encryption of AI Data at Rest 6 6 6 in force
The 6 laws behind ID.DE-P3 and AIR-PREV-014
AIR-PREV-017AI Firewall Implementation and Management 6 6 6 in force
The 6 laws behind ID.DE-P3 and AIR-PREV-017
AIR-PREV-020MCP Server Security Governance 6 6 6 in force
The 6 laws behind ID.DE-P3 and AIR-PREV-020
AIR-DET-001AI Data Leakage Prevention and Detection 6 6 6 in force
The 6 laws behind ID.DE-P3 and AIR-DET-001
AIR-DET-021Agent Decision Audit and Explainability 3 3 2 in force, 1 not yet in force
The 3 laws behind ID.DE-P3 and AIR-DET-021
AIR-PREV-005System Acceptance Testing 2 2 2 in force
The 2 laws behind ID.DE-P3 and AIR-PREV-005
AIR-DET-004AI System Observability 2 2 1 in force, 1 not yet in force
The 2 laws behind ID.DE-P3 and AIR-DET-004
GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such... AIR-DET-021Agent Decision Audit and Explainability 65 61 56 in force, 6 not yet in force, 3 proposed
The 65 laws behind GV.PO-P1 and AIR-DET-021

and 55 more, every one in the free file.

AIR-DET-004AI System Observability 64 60 55 in force, 6 not yet in force, 3 proposed
The 64 laws behind GV.PO-P1 and AIR-DET-004

and 54 more, every one in the free file.

AIR-PREV-005System Acceptance Testing 58 53 48 in force, 6 not yet in force, 4 proposed
The 58 laws behind GV.PO-P1 and AIR-PREV-005

and 48 more, every one in the free file.

AIR-PREV-006Data Quality & Classification/Sensitivity 55 52 48 in force, 4 not yet in force, 3 proposed
The 55 laws behind GV.PO-P1 and AIR-PREV-006

and 45 more, every one in the free file.

AIR-PREV-024Human-in-the-Loop Action Approval Gate 55 52 48 in force, 4 not yet in force, 3 proposed
The 55 laws behind GV.PO-P1 and AIR-PREV-024

and 45 more, every one in the free file.

AIR-DET-011Human Feedback Loop for AI Systems 55 52 48 in force, 4 not yet in force, 3 proposed
The 55 laws behind GV.PO-P1 and AIR-DET-011

and 45 more, every one in the free file.

AIR-PREV-007Legal and Contractual Frameworks for AI Systems 3 3 3 in force
The 3 laws behind GV.PO-P1 and AIR-PREV-007
AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems 3 3 3 in force
The 3 laws behind GV.PO-P1 and AIR-PREV-008
AIR-PREV-012Role-Based Access Control for AI Data 3 3 3 in force
The 3 laws behind GV.PO-P1 and AIR-PREV-012
AIR-PREV-014Encryption of AI Data at Rest 3 3 3 in force
The 3 laws behind GV.PO-P1 and AIR-PREV-014
AIR-PREV-017AI Firewall Implementation and Management 3 3 3 in force
The 3 laws behind GV.PO-P1 and AIR-PREV-017
AIR-PREV-020MCP Server Security Governance 3 3 3 in force
The 3 laws behind GV.PO-P1 and AIR-PREV-020
AIR-DET-001AI Data Leakage Prevention and Detection 3 3 3 in force
The 3 laws behind GV.PO-P1 and AIR-DET-001
GV.PO-P2Processes to instill organizational privacy values within system/product/service... AIR-PREV-005System Acceptance Testing 9 9 9 in force
The 9 laws behind GV.PO-P2 and AIR-PREV-005
AIR-PREV-006Data Quality & Classification/Sensitivity 6 6 6 in force
The 6 laws behind GV.PO-P2 and AIR-PREV-006
AIR-PREV-007Legal and Contractual Frameworks for AI Systems 6 6 5 in force, 1 proposed
The 6 laws behind GV.PO-P2 and AIR-PREV-007
AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems 6 6 5 in force, 1 proposed
The 6 laws behind GV.PO-P2 and AIR-PREV-008
AIR-PREV-012Role-Based Access Control for AI Data 6 6 5 in force, 1 proposed
The 6 laws behind GV.PO-P2 and AIR-PREV-012
AIR-PREV-014Encryption of AI Data at Rest 6 6 5 in force, 1 proposed
The 6 laws behind GV.PO-P2 and AIR-PREV-014
AIR-PREV-017AI Firewall Implementation and Management 6 6 5 in force, 1 proposed
The 6 laws behind GV.PO-P2 and AIR-PREV-017
AIR-PREV-020MCP Server Security Governance 6 6 5 in force, 1 proposed
The 6 laws behind GV.PO-P2 and AIR-PREV-020
AIR-PREV-024Human-in-the-Loop Action Approval Gate 6 6 6 in force
The 6 laws behind GV.PO-P2 and AIR-PREV-024
AIR-DET-001AI Data Leakage Prevention and Detection 6 6 5 in force, 1 proposed
The 6 laws behind GV.PO-P2 and AIR-DET-001
AIR-DET-004AI System Observability 6 6 6 in force
The 6 laws behind GV.PO-P2 and AIR-DET-004
AIR-DET-011Human Feedback Loop for AI Systems 6 6 6 in force
The 6 laws behind GV.PO-P2 and AIR-DET-011
AIR-DET-021Agent Decision Audit and Explainability 6 6 6 in force
The 6 laws behind GV.PO-P2 and AIR-DET-021
GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy. AIR-PREV-006Data Quality & Classification/Sensitivity 46 44 40 in force, 3 not yet in force, 3 proposed
The 46 laws behind GV.PO-P3 and AIR-PREV-006

and 36 more, every one in the free file.

AIR-DET-021Agent Decision Audit and Explainability 46 44 40 in force, 3 not yet in force, 3 proposed
The 46 laws behind GV.PO-P3 and AIR-DET-021

and 36 more, every one in the free file.

AIR-PREV-005System Acceptance Testing 45 43 39 in force, 3 not yet in force, 3 proposed
The 45 laws behind GV.PO-P3 and AIR-PREV-005

and 35 more, every one in the free file.

AIR-PREV-024Human-in-the-Loop Action Approval Gate 45 43 39 in force, 3 not yet in force, 3 proposed
The 45 laws behind GV.PO-P3 and AIR-PREV-024

and 35 more, every one in the free file.

AIR-DET-004AI System Observability 45 43 39 in force, 3 not yet in force, 3 proposed
The 45 laws behind GV.PO-P3 and AIR-DET-004

and 35 more, every one in the free file.

AIR-DET-011Human Feedback Loop for AI Systems 45 43 39 in force, 3 not yet in force, 3 proposed
The 45 laws behind GV.PO-P3 and AIR-DET-011

and 35 more, every one in the free file.

AIR-PREV-007Legal and Contractual Frameworks for AI Systems 4 4 4 in force
The 4 laws behind GV.PO-P3 and AIR-PREV-007
AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems 3 3 3 in force
The 3 laws behind GV.PO-P3 and AIR-PREV-008
AIR-PREV-012Role-Based Access Control for AI Data 3 3 3 in force
The 3 laws behind GV.PO-P3 and AIR-PREV-012
AIR-PREV-014Encryption of AI Data at Rest 3 3 3 in force
The 3 laws behind GV.PO-P3 and AIR-PREV-014
AIR-PREV-017AI Firewall Implementation and Management 3 3 3 in force
The 3 laws behind GV.PO-P3 and AIR-PREV-017
AIR-PREV-020MCP Server Security Governance 3 3 3 in force
The 3 laws behind GV.PO-P3 and AIR-PREV-020
AIR-DET-001AI Data Leakage Prevention and Detection 3 3 3 in force
The 3 laws behind GV.PO-P3 and AIR-DET-001
GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed. AIR-DET-004AI System Observability 140 87 125 in force, 9 not yet in force, 6 proposed
The 140 laws behind GV.PO-P5 and AIR-DET-004

and 130 more, every one in the free file.

AIR-DET-021Agent Decision Audit and Explainability 140 87 125 in force, 9 not yet in force, 6 proposed
The 140 laws behind GV.PO-P5 and AIR-DET-021

and 130 more, every one in the free file.

AIR-PREV-005System Acceptance Testing 133 85 118 in force, 9 not yet in force, 6 proposed
The 133 laws behind GV.PO-P5 and AIR-PREV-005

and 123 more, every one in the free file.

AIR-PREV-006Data Quality & Classification/Sensitivity 133 85 118 in force, 9 not yet in force, 6 proposed
The 133 laws behind GV.PO-P5 and AIR-PREV-006

and 123 more, every one in the free file.

AIR-PREV-024Human-in-the-Loop Action Approval Gate 132 85 117 in force, 9 not yet in force, 6 proposed
The 132 laws behind GV.PO-P5 and AIR-PREV-024

and 122 more, every one in the free file.

AIR-DET-011Human Feedback Loop for AI Systems 132 85 117 in force, 9 not yet in force, 6 proposed
The 132 laws behind GV.PO-P5 and AIR-DET-011

and 122 more, every one in the free file.

AIR-PREV-007Legal and Contractual Frameworks for AI Systems 5 5 5 in force
The 5 laws behind GV.PO-P5 and AIR-PREV-007
AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems 3 3 3 in force
The 3 laws behind GV.PO-P5 and AIR-PREV-008
AIR-PREV-012Role-Based Access Control for AI Data 3 3 3 in force
The 3 laws behind GV.PO-P5 and AIR-PREV-012
AIR-PREV-014Encryption of AI Data at Rest 3 3 3 in force
The 3 laws behind GV.PO-P5 and AIR-PREV-014
AIR-PREV-017AI Firewall Implementation and Management 3 3 3 in force
The 3 laws behind GV.PO-P5 and AIR-PREV-017
AIR-PREV-020MCP Server Security Governance 3 3 3 in force
The 3 laws behind GV.PO-P5 and AIR-PREV-020
AIR-DET-001AI Data Leakage Prevention and Detection 3 3 3 in force
The 3 laws behind GV.PO-P5 and AIR-DET-001
GV.AT-P1The workforce is informed and trained on its roles and responsibilities. AIR-PREV-007Legal and Contractual Frameworks for AI Systems 4 4 4 in force
The 4 laws behind GV.AT-P1 and AIR-PREV-007
AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems 4 4 4 in force
The 4 laws behind GV.AT-P1 and AIR-PREV-008
AIR-PREV-012Role-Based Access Control for AI Data 4 4 4 in force
The 4 laws behind GV.AT-P1 and AIR-PREV-012
AIR-PREV-014Encryption of AI Data at Rest 4 4 4 in force
The 4 laws behind GV.AT-P1 and AIR-PREV-014
AIR-PREV-017AI Firewall Implementation and Management 4 4 4 in force
The 4 laws behind GV.AT-P1 and AIR-PREV-017
AIR-PREV-020MCP Server Security Governance 4 4 4 in force
The 4 laws behind GV.AT-P1 and AIR-PREV-020
AIR-DET-001AI Data Leakage Prevention and Detection 4 4 4 in force
The 4 laws behind GV.AT-P1 and AIR-DET-001
AIR-PREV-005System Acceptance Testing 3 3 3 in force
The 3 laws behind GV.AT-P1 and AIR-PREV-005
AIR-PREV-006Data Quality & Classification/Sensitivity 2 2 2 in force
The 2 laws behind GV.AT-P1 and AIR-PREV-006
AIR-PREV-024Human-in-the-Loop Action Approval Gate 2 2 2 in force
The 2 laws behind GV.AT-P1 and AIR-PREV-024
AIR-DET-004AI System Observability 2 2 2 in force
The 2 laws behind GV.AT-P1 and AIR-DET-004
AIR-DET-011Human Feedback Loop for AI Systems 2 2 2 in force
The 2 laws behind GV.AT-P1 and AIR-DET-011
AIR-DET-021Agent Decision Audit and Explainability 2 2 2 in force
The 2 laws behind GV.AT-P1 and AIR-DET-021
GV.MT-P3Policies, processes, and procedures for assessing compliance with legal requirements... AIR-PREV-005System Acceptance Testing 10 8 8 in force, 1 not yet in force, 1 proposed
The 10 laws behind GV.MT-P3 and AIR-PREV-005
AIR-PREV-006Data Quality & Classification/Sensitivity 10 8 8 in force, 1 not yet in force, 1 proposed
The 10 laws behind GV.MT-P3 and AIR-PREV-006
AIR-PREV-024Human-in-the-Loop Action Approval Gate 10 8 8 in force, 1 not yet in force, 1 proposed
The 10 laws behind GV.MT-P3 and AIR-PREV-024
AIR-DET-004AI System Observability 10 8 8 in force, 1 not yet in force, 1 proposed
The 10 laws behind GV.MT-P3 and AIR-DET-004
AIR-DET-011Human Feedback Loop for AI Systems 10 8 8 in force, 1 not yet in force, 1 proposed
The 10 laws behind GV.MT-P3 and AIR-DET-011
AIR-DET-021Agent Decision Audit and Explainability 10 8 8 in force, 1 not yet in force, 1 proposed
The 10 laws behind GV.MT-P3 and AIR-DET-021
GV.MT-P4Policies, processes, and procedures for communicating progress on managing privacy... AIR-DET-004AI System Observability 5 5 5 in force
The 5 laws behind GV.MT-P4 and AIR-DET-004
AIR-DET-021Agent Decision Audit and Explainability 4 4 4 in force
The 4 laws behind GV.MT-P4 and AIR-DET-021
AIR-PREV-005System Acceptance Testing 2 1 2 in force
The 2 laws behind GV.MT-P4 and AIR-PREV-005
GV.MT-P7Policies, processes, and procedures for receiving, tracking, and responding to... AIR-DET-021Agent Decision Audit and Explainability 9 9 9 in force
The 9 laws behind GV.MT-P7 and AIR-DET-021
AIR-PREV-006Data Quality & Classification/Sensitivity 6 6 6 in force
The 6 laws behind GV.MT-P7 and AIR-PREV-006
CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g.,... AIR-PREV-005System Acceptance Testing 290 139 265 in force, 17 not yet in force, 8 proposed
The 290 laws behind CT.PO-P1 and AIR-PREV-005

and 280 more, every one in the free file.

AIR-PREV-006Data Quality & Classification/Sensitivity 95 76 82 in force, 7 not yet in force, 6 proposed
The 95 laws behind CT.PO-P1 and AIR-PREV-006

and 85 more, every one in the free file.

AIR-DET-021Agent Decision Audit and Explainability 45 37 41 in force, 1 not yet in force, 3 proposed
The 45 laws behind CT.PO-P1 and AIR-DET-021

and 35 more, every one in the free file.

AIR-PREV-018Agent Authority Least Privilege Framework 25 24 25 in force
The 25 laws behind CT.PO-P1 and AIR-PREV-018

and 15 more, every one in the free file.

AIR-PREV-023Agentic System Credential Protection Framework 25 24 25 in force
The 25 laws behind CT.PO-P1 and AIR-PREV-023

and 15 more, every one in the free file.

AIR-DET-004AI System Observability 20 19 17 in force, 1 not yet in force, 2 proposed
The 20 laws behind CT.PO-P1 and AIR-DET-004

and 10 more, every one in the free file.

AIR-PREV-024Human-in-the-Loop Action Approval Gate 18 17 15 in force, 1 not yet in force, 2 proposed
The 18 laws behind CT.PO-P1 and AIR-PREV-024

and 8 more, every one in the free file.

AIR-DET-011Human Feedback Loop for AI Systems 18 17 15 in force, 1 not yet in force, 2 proposed
The 18 laws behind CT.PO-P1 and AIR-DET-011

and 8 more, every one in the free file.

AIR-PREV-007Legal and Contractual Frameworks for AI Systems 8 7 8 in force
The 8 laws behind CT.PO-P1 and AIR-PREV-007
AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems 7 7 7 in force
The 7 laws behind CT.PO-P1 and AIR-PREV-008
AIR-PREV-012Role-Based Access Control for AI Data 7 7 7 in force
The 7 laws behind CT.PO-P1 and AIR-PREV-012
AIR-PREV-014Encryption of AI Data at Rest 7 7 7 in force
The 7 laws behind CT.PO-P1 and AIR-PREV-014
AIR-PREV-017AI Firewall Implementation and Management 7 7 7 in force
The 7 laws behind CT.PO-P1 and AIR-PREV-017
AIR-PREV-020MCP Server Security Governance 7 7 7 in force
The 7 laws behind CT.PO-P1 and AIR-PREV-020
AIR-DET-001AI Data Leakage Prevention and Detection 7 7 7 in force
The 7 laws behind CT.PO-P1 and AIR-DET-001
CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or... AIR-PREV-007Legal and Contractual Frameworks for AI Systems 88 84 78 in force, 5 not yet in force, 5 proposed
The 88 laws behind CT.PO-P2 and AIR-PREV-007

and 78 more, every one in the free file.

AIR-DET-021Agent Decision Audit and Explainability 42 36 36 in force, 5 not yet in force, 1 proposed
The 42 laws behind CT.PO-P2 and AIR-DET-021

and 32 more, every one in the free file.

AIR-DET-004AI System Observability 40 35 34 in force, 5 not yet in force, 1 proposed
The 40 laws behind CT.PO-P2 and AIR-DET-004

and 30 more, every one in the free file.

AIR-PREV-006Data Quality & Classification/Sensitivity 6 5 6 in force
The 6 laws behind CT.PO-P2 and AIR-PREV-006
AIR-PREV-005System Acceptance Testing 5 5 5 in force
The 5 laws behind CT.PO-P2 and AIR-PREV-005
AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems 4 4 3 in force, 1 proposed
The 4 laws behind CT.PO-P2 and AIR-PREV-008
AIR-PREV-012Role-Based Access Control for AI Data 4 4 3 in force, 1 proposed
The 4 laws behind CT.PO-P2 and AIR-PREV-012
AIR-PREV-014Encryption of AI Data at Rest 4 4 3 in force, 1 proposed
The 4 laws behind CT.PO-P2 and AIR-PREV-014
AIR-PREV-017AI Firewall Implementation and Management 4 4 3 in force, 1 proposed
The 4 laws behind CT.PO-P2 and AIR-PREV-017
AIR-PREV-020MCP Server Security Governance 4 4 3 in force, 1 proposed
The 4 laws behind CT.PO-P2 and AIR-PREV-020
AIR-PREV-024Human-in-the-Loop Action Approval Gate 4 4 4 in force
The 4 laws behind CT.PO-P2 and AIR-PREV-024
AIR-DET-001AI Data Leakage Prevention and Detection 4 4 3 in force, 1 proposed
The 4 laws behind CT.PO-P2 and AIR-DET-001
AIR-DET-011Human Feedback Loop for AI Systems 4 4 4 in force
The 4 laws behind CT.PO-P2 and AIR-DET-011
CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing... AIR-DET-021Agent Decision Audit and Explainability 158 125 136 in force, 17 not yet in force, 5 proposed
The 158 laws behind CT.PO-P3 and AIR-DET-021

and 148 more, every one in the free file.

AIR-PREV-006Data Quality & Classification/Sensitivity 125 99 103 in force, 17 not yet in force, 5 proposed
The 125 laws behind CT.PO-P3 and AIR-PREV-006

and 115 more, every one in the free file.

AIR-PREV-005System Acceptance Testing 72 44 70 in force, 2 not yet in force
The 72 laws behind CT.PO-P3 and AIR-PREV-005

and 62 more, every one in the free file.

AIR-DET-004AI System Observability 2 2 1 in force, 1 not yet in force
The 2 laws behind CT.PO-P3 and AIR-DET-004
CT.DM-P1Data elements can be accessed for review. AIR-DET-021Agent Decision Audit and Explainability 64 59 57 in force, 7 not yet in force
The 64 laws behind CT.DM-P1 and AIR-DET-021

and 54 more, every one in the free file.

AIR-PREV-006Data Quality & Classification/Sensitivity 61 59 54 in force, 7 not yet in force
The 61 laws behind CT.DM-P1 and AIR-PREV-006

and 51 more, every one in the free file.

AIR-DET-004AI System Observability 3 2 3 in force
The 3 laws behind CT.DM-P1 and AIR-DET-004
CT.DM-P2Data elements can be accessed for transmission or disclosure. AIR-PREV-006Data Quality & Classification/Sensitivity 21 19 17 in force, 3 not yet in force, 1 proposed
The 21 laws behind CT.DM-P2 and AIR-PREV-006

and 11 more, every one in the free file.

AIR-DET-021Agent Decision Audit and Explainability 21 19 17 in force, 3 not yet in force, 1 proposed
The 21 laws behind CT.DM-P2 and AIR-DET-021

and 11 more, every one in the free file.
CT.DM-P3Data elements can be accessed for alteration. AIR-DET-021Agent Decision Audit and Explainability 22 22 16 in force, 6 not yet in force
The 22 laws behind CT.DM-P3 and AIR-DET-021

and 12 more, every one in the free file.

AIR-PREV-006Data Quality & Classification/Sensitivity 21 21 15 in force, 6 not yet in force
The 21 laws behind CT.DM-P3 and AIR-PREV-006

and 11 more, every one in the free file.
CT.DM-P4Data elements can be accessed for deletion. AIR-PREV-006Data Quality & Classification/Sensitivity 18 18 17 in force, 1 not yet in force
The 18 laws behind CT.DM-P4 and AIR-PREV-006

and 8 more, every one in the free file.

AIR-DET-021Agent Decision Audit and Explainability 18 18 17 in force, 1 not yet in force
The 18 laws behind CT.DM-P4 and AIR-DET-021

and 8 more, every one in the free file.
CT.DM-P5Data are destroyed according to policy. AIR-DET-021Agent Decision Audit and Explainability 58 52 53 in force, 4 not yet in force, 1 proposed
The 58 laws behind CT.DM-P5 and AIR-DET-021

and 48 more, every one in the free file.

AIR-DET-004AI System Observability 56 50 51 in force, 4 not yet in force, 1 proposed
The 56 laws behind CT.DM-P5 and AIR-DET-004

and 46 more, every one in the free file.

AIR-PREV-005System Acceptance Testing 8 8 7 in force, 1 not yet in force
The 8 laws behind CT.DM-P5 and AIR-PREV-005
AIR-PREV-006Data Quality & Classification/Sensitivity 6 6 6 in force
The 6 laws behind CT.DM-P5 and AIR-PREV-006
AIR-PREV-024Human-in-the-Loop Action Approval Gate 4 4 4 in force
The 4 laws behind CT.DM-P5 and AIR-PREV-024
AIR-DET-011Human Feedback Loop for AI Systems 4 4 4 in force
The 4 laws behind CT.DM-P5 and AIR-DET-011
AIR-PREV-007Legal and Contractual Frameworks for AI Systems 2 2 2 in force
The 2 laws behind CT.DM-P5 and AIR-PREV-007
CT.DM-P6Data are transmitted using standardized formats. AIR-PREV-006Data Quality & Classification/Sensitivity 5 4 2 in force, 2 not yet in force, 1 proposed
The 5 laws behind CT.DM-P6 and AIR-PREV-006
AIR-DET-021Agent Decision Audit and Explainability 5 4 2 in force, 2 not yet in force, 1 proposed
The 5 laws behind CT.DM-P6 and AIR-DET-021
CT.DM-P8Audit/log records are determined, documented, implemented, and reviewed in accordance... AIR-DET-004AI System Observability 20 15 15 in force, 5 not yet in force
The 20 laws behind CT.DM-P8 and AIR-DET-004

and 10 more, every one in the free file.

AIR-DET-021Agent Decision Audit and Explainability 20 15 15 in force, 5 not yet in force
The 20 laws behind CT.DM-P8 and AIR-DET-021

and 10 more, every one in the free file.

AIR-PREV-005System Acceptance Testing 16 11 11 in force, 5 not yet in force
The 16 laws behind CT.DM-P8 and AIR-PREV-005

and 6 more, every one in the free file.

AIR-PREV-006Data Quality & Classification/Sensitivity 16 11 11 in force, 5 not yet in force
The 16 laws behind CT.DM-P8 and AIR-PREV-006

and 6 more, every one in the free file.

AIR-PREV-024Human-in-the-Loop Action Approval Gate 16 11 11 in force, 5 not yet in force
The 16 laws behind CT.DM-P8 and AIR-PREV-024

and 6 more, every one in the free file.

AIR-DET-011Human Feedback Loop for AI Systems 16 11 11 in force, 5 not yet in force
The 16 laws behind CT.DM-P8 and AIR-DET-011

and 6 more, every one in the free file.

AIR-PREV-007Legal and Contractual Frameworks for AI Systems 4 4 4 in force
The 4 laws behind CT.DM-P8 and AIR-PREV-007
AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems 4 4 4 in force
The 4 laws behind CT.DM-P8 and AIR-PREV-008
AIR-PREV-012Role-Based Access Control for AI Data 4 4 4 in force
The 4 laws behind CT.DM-P8 and AIR-PREV-012
AIR-PREV-014Encryption of AI Data at Rest 4 4 4 in force
The 4 laws behind CT.DM-P8 and AIR-PREV-014
AIR-PREV-017AI Firewall Implementation and Management 4 4 4 in force
The 4 laws behind CT.DM-P8 and AIR-PREV-017
AIR-PREV-020MCP Server Security Governance 4 4 4 in force
The 4 laws behind CT.DM-P8 and AIR-PREV-020
AIR-DET-001AI Data Leakage Prevention and Detection 4 4 4 in force
The 4 laws behind CT.DM-P8 and AIR-DET-001
CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and... AIR-PREV-005System Acceptance Testing 4 4 3 in force, 1 not yet in force
The 4 laws behind CT.DM-P10 and AIR-PREV-005
AIR-PREV-006Data Quality & Classification/Sensitivity 4 4 2 in force, 2 not yet in force
The 4 laws behind CT.DM-P10 and AIR-PREV-006
AIR-DET-021Agent Decision Audit and Explainability 4 4 2 in force, 2 not yet in force
The 4 laws behind CT.DM-P10 and AIR-DET-021
AIR-PREV-024Human-in-the-Loop Action Approval Gate 3 3 2 in force, 1 not yet in force
The 3 laws behind CT.DM-P10 and AIR-PREV-024
AIR-DET-004AI System Observability 3 3 2 in force, 1 not yet in force
The 3 laws behind CT.DM-P10 and AIR-DET-004
AIR-DET-011Human Feedback Loop for AI Systems 3 3 2 in force, 1 not yet in force
The 3 laws behind CT.DM-P10 and AIR-DET-011
CT.DP-P2Data are processed to limit the identification of individuals (e.g., de-identification... AIR-DET-004AI System Observability 2 2 2 in force
The 2 laws behind CT.DP-P2 and AIR-DET-004
AIR-DET-021Agent Decision Audit and Explainability 2 2 2 in force
The 2 laws behind CT.DP-P2 and AIR-DET-021
CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data... AIR-DET-021Agent Decision Audit and Explainability 209 130 191 in force, 14 not yet in force, 4 proposed
The 209 laws behind CM.AW-P1 and AIR-DET-021

and 199 more, every one in the free file.

AIR-PREV-005System Acceptance Testing 40 36 40 in force
The 40 laws behind CM.AW-P1 and AIR-PREV-005

and 30 more, every one in the free file.

AIR-PREV-006Data Quality & Classification/Sensitivity 33 32 27 in force, 3 not yet in force, 3 proposed
The 33 laws behind CM.AW-P1 and AIR-PREV-006

and 23 more, every one in the free file.

AIR-DET-004AI System Observability 10 10 9 in force, 1 not yet in force
The 10 laws behind CM.AW-P1 and AIR-DET-004
AIR-PREV-024Human-in-the-Loop Action Approval Gate 5 5 5 in force
The 5 laws behind CM.AW-P1 and AIR-PREV-024
AIR-DET-011Human Feedback Loop for AI Systems 5 5 5 in force
The 5 laws behind CM.AW-P1 and AIR-DET-011
AIR-PREV-007Legal and Contractual Frameworks for AI Systems 4 4 4 in force
The 4 laws behind CM.AW-P1 and AIR-PREV-007
AIR-DET-001AI Data Leakage Prevention and Detection 2 2 1 in force, 1 not yet in force
The 2 laws behind CM.AW-P1 and AIR-DET-001
CM.AW-P4Records of data disclosures and sharing are maintained and can be accessed for review... AIR-DET-021Agent Decision Audit and Explainability 7 7 6 in force, 1 not yet in force
The 7 laws behind CM.AW-P4 and AIR-DET-021
AIR-PREV-006Data Quality & Classification/Sensitivity 3 3 2 in force, 1 not yet in force
The 3 laws behind CM.AW-P4 and AIR-PREV-006
CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations... AIR-DET-021Agent Decision Audit and Explainability 49 45 46 in force, 3 not yet in force
The 49 laws behind CM.AW-P5 and AIR-DET-021

and 39 more, every one in the free file.

AIR-PREV-006Data Quality & Classification/Sensitivity 47 45 44 in force, 3 not yet in force
The 47 laws behind CM.AW-P5 and AIR-PREV-006

and 37 more, every one in the free file.

AIR-DET-004AI System Observability 5 4 3 in force, 2 not yet in force
The 5 laws behind CM.AW-P5 and AIR-DET-004
AIR-PREV-005System Acceptance Testing 4 4 2 in force, 2 not yet in force
The 4 laws behind CM.AW-P5 and AIR-PREV-005
AIR-PREV-024Human-in-the-Loop Action Approval Gate 3 3 1 in force, 2 not yet in force
The 3 laws behind CM.AW-P5 and AIR-PREV-024
AIR-DET-011Human Feedback Loop for AI Systems 3 3 1 in force, 2 not yet in force
The 3 laws behind CM.AW-P5 and AIR-DET-011
CM.AW-P6Data provenance and lineage are maintained and can be accessed for review or... AIR-DET-021Agent Decision Audit and Explainability 2 2 1 in force, 1 not yet in force
The 2 laws behind CM.AW-P6 and AIR-DET-021
CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event. AIR-DET-004AI System Observability 123 99 110 in force, 5 not yet in force, 8 proposed
The 123 laws behind CM.AW-P7 and AIR-DET-004

and 113 more, every one in the free file.

AIR-DET-001AI Data Leakage Prevention and Detection 90 82 81 in force, 5 not yet in force, 4 proposed
The 90 laws behind CM.AW-P7 and AIR-DET-001

and 80 more, every one in the free file.

AIR-DET-021Agent Decision Audit and Explainability 84 72 73 in force, 4 not yet in force, 7 proposed
The 84 laws behind CM.AW-P7 and AIR-DET-021

and 74 more, every one in the free file.

AIR-PREV-007Legal and Contractual Frameworks for AI Systems 2 2 2 in force
The 2 laws behind CM.AW-P7 and AIR-PREV-007
AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems 2 2 2 in force
The 2 laws behind CM.AW-P7 and AIR-PREV-008
AIR-PREV-012Role-Based Access Control for AI Data 2 2 2 in force
The 2 laws behind CM.AW-P7 and AIR-PREV-012
AIR-PREV-014Encryption of AI Data at Rest 2 2 2 in force
The 2 laws behind CM.AW-P7 and AIR-PREV-014
AIR-PREV-017AI Firewall Implementation and Management 2 2 2 in force
The 2 laws behind CM.AW-P7 and AIR-PREV-017
AIR-PREV-020MCP Server Security Governance 2 2 2 in force
The 2 laws behind CM.AW-P7 and AIR-PREV-020
PR.PO-P3Backups of information are conducted, maintained, and tested. AIR-PREV-007Legal and Contractual Frameworks for AI Systems 3 3 3 in force
The 3 laws behind PR.PO-P3 and AIR-PREV-007
AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems 3 3 3 in force
The 3 laws behind PR.PO-P3 and AIR-PREV-008
AIR-PREV-012Role-Based Access Control for AI Data 3 3 3 in force
The 3 laws behind PR.PO-P3 and AIR-PREV-012
AIR-PREV-014Encryption of AI Data at Rest 3 3 3 in force
The 3 laws behind PR.PO-P3 and AIR-PREV-014
AIR-PREV-017AI Firewall Implementation and Management 3 3 3 in force
The 3 laws behind PR.PO-P3 and AIR-PREV-017
AIR-PREV-020MCP Server Security Governance 3 3 3 in force
The 3 laws behind PR.PO-P3 and AIR-PREV-020
AIR-DET-001AI Data Leakage Prevention and Detection 3 3 3 in force
The 3 laws behind PR.PO-P3 and AIR-DET-001
AIR-PREV-005System Acceptance Testing 2 2 1 in force, 1 not yet in force
The 2 laws behind PR.PO-P3 and AIR-PREV-005
AIR-PREV-006Data Quality & Classification/Sensitivity 2 2 1 in force, 1 not yet in force
The 2 laws behind PR.PO-P3 and AIR-PREV-006
AIR-PREV-024Human-in-the-Loop Action Approval Gate 2 2 1 in force, 1 not yet in force
The 2 laws behind PR.PO-P3 and AIR-PREV-024
AIR-DET-004AI System Observability 2 2 1 in force, 1 not yet in force
The 2 laws behind PR.PO-P3 and AIR-DET-004
AIR-DET-011Human Feedback Loop for AI Systems 2 2 1 in force, 1 not yet in force
The 2 laws behind PR.PO-P3 and AIR-DET-011
AIR-DET-021Agent Decision Audit and Explainability 2 2 1 in force, 1 not yet in force
The 2 laws behind PR.PO-P3 and AIR-DET-021
PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans... AIR-DET-004AI System Observability 88 60 82 in force, 4 not yet in force, 2 proposed
The 88 laws behind PR.PO-P7 and AIR-DET-004

and 78 more, every one in the free file.

AIR-DET-021Agent Decision Audit and Explainability 77 56 72 in force, 4 not yet in force, 1 proposed
The 77 laws behind PR.PO-P7 and AIR-DET-021

and 67 more, every one in the free file.

AIR-DET-001AI Data Leakage Prevention and Detection 61 46 59 in force, 1 not yet in force, 1 proposed
The 61 laws behind PR.PO-P7 and AIR-DET-001

and 51 more, every one in the free file.

AIR-PREV-005System Acceptance Testing 50 36 47 in force, 2 not yet in force, 1 proposed
The 50 laws behind PR.PO-P7 and AIR-PREV-005

and 40 more, every one in the free file.

AIR-PREV-006Data Quality & Classification/Sensitivity 50 36 47 in force, 2 not yet in force, 1 proposed
The 50 laws behind PR.PO-P7 and AIR-PREV-006

and 40 more, every one in the free file.

AIR-PREV-024Human-in-the-Loop Action Approval Gate 50 36 47 in force, 2 not yet in force, 1 proposed
The 50 laws behind PR.PO-P7 and AIR-PREV-024

and 40 more, every one in the free file.

AIR-DET-011Human Feedback Loop for AI Systems 50 36 47 in force, 2 not yet in force, 1 proposed
The 50 laws behind PR.PO-P7 and AIR-DET-011

and 40 more, every one in the free file.

AIR-PREV-007Legal and Contractual Frameworks for AI Systems 32 24 31 in force, 1 not yet in force
The 32 laws behind PR.PO-P7 and AIR-PREV-007

and 22 more, every one in the free file.

AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems 32 24 31 in force, 1 not yet in force
The 32 laws behind PR.PO-P7 and AIR-PREV-008

and 22 more, every one in the free file.

AIR-PREV-012Role-Based Access Control for AI Data 32 24 31 in force, 1 not yet in force
The 32 laws behind PR.PO-P7 and AIR-PREV-012

and 22 more, every one in the free file.

AIR-PREV-014Encryption of AI Data at Rest 32 24 31 in force, 1 not yet in force
The 32 laws behind PR.PO-P7 and AIR-PREV-014

and 22 more, every one in the free file.

AIR-PREV-017AI Firewall Implementation and Management 32 24 31 in force, 1 not yet in force
The 32 laws behind PR.PO-P7 and AIR-PREV-017

and 22 more, every one in the free file.

AIR-PREV-020MCP Server Security Governance 32 24 31 in force, 1 not yet in force
The 32 laws behind PR.PO-P7 and AIR-PREV-020

and 22 more, every one in the free file.
PR.PO-P8Response and recovery plans are tested. AIR-PREV-007Legal and Contractual Frameworks for AI Systems 6 5 6 in force
The 6 laws behind PR.PO-P8 and AIR-PREV-007
AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems 6 5 6 in force
The 6 laws behind PR.PO-P8 and AIR-PREV-008
AIR-PREV-012Role-Based Access Control for AI Data 6 5 6 in force
The 6 laws behind PR.PO-P8 and AIR-PREV-012
AIR-PREV-014Encryption of AI Data at Rest 6 5 6 in force
The 6 laws behind PR.PO-P8 and AIR-PREV-014
AIR-PREV-017AI Firewall Implementation and Management 6 5 6 in force
The 6 laws behind PR.PO-P8 and AIR-PREV-017
AIR-PREV-020MCP Server Security Governance 6 5 6 in force
The 6 laws behind PR.PO-P8 and AIR-PREV-020
AIR-DET-001AI Data Leakage Prevention and Detection 6 5 6 in force
The 6 laws behind PR.PO-P8 and AIR-DET-001
AIR-PREV-005System Acceptance Testing 2 2 2 in force
The 2 laws behind PR.PO-P8 and AIR-PREV-005
AIR-PREV-006Data Quality & Classification/Sensitivity 2 2 2 in force
The 2 laws behind PR.PO-P8 and AIR-PREV-006
AIR-PREV-024Human-in-the-Loop Action Approval Gate 2 2 2 in force
The 2 laws behind PR.PO-P8 and AIR-PREV-024
AIR-DET-004AI System Observability 2 2 2 in force
The 2 laws behind PR.PO-P8 and AIR-DET-004
AIR-DET-011Human Feedback Loop for AI Systems 2 2 2 in force
The 2 laws behind PR.PO-P8 and AIR-DET-011
AIR-DET-021Agent Decision Audit and Explainability 2 2 2 in force
The 2 laws behind PR.PO-P8 and AIR-DET-021
PR.PO-P9Privacy procedures are included in human resources practices (e.g., deprovisioning,... AIR-PREV-005System Acceptance Testing 2 2 1 in force, 1 proposed
The 2 laws behind PR.PO-P9 and AIR-PREV-005
AIR-PREV-006Data Quality & Classification/Sensitivity 2 2 1 in force, 1 proposed
The 2 laws behind PR.PO-P9 and AIR-PREV-006
AIR-PREV-024Human-in-the-Loop Action Approval Gate 2 2 1 in force, 1 proposed
The 2 laws behind PR.PO-P9 and AIR-PREV-024
AIR-DET-004AI System Observability 2 2 1 in force, 1 proposed
The 2 laws behind PR.PO-P9 and AIR-DET-004
AIR-DET-011Human Feedback Loop for AI Systems 2 2 1 in force, 1 proposed
The 2 laws behind PR.PO-P9 and AIR-DET-011
AIR-DET-021Agent Decision Audit and Explainability 2 2 1 in force, 1 proposed
The 2 laws behind PR.PO-P9 and AIR-DET-021
PR.PO-P10A vulnerability management plan is developed and implemented. AIR-PREV-007Legal and Contractual Frameworks for AI Systems 15 10 13 in force, 2 not yet in force
The 15 laws behind PR.PO-P10 and AIR-PREV-007

and 5 more, every one in the free file.

AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems 15 10 13 in force, 2 not yet in force
The 15 laws behind PR.PO-P10 and AIR-PREV-008

and 5 more, every one in the free file.

AIR-PREV-012Role-Based Access Control for AI Data 15 10 13 in force, 2 not yet in force
The 15 laws behind PR.PO-P10 and AIR-PREV-012

and 5 more, every one in the free file.

AIR-PREV-014Encryption of AI Data at Rest 15 10 13 in force, 2 not yet in force
The 15 laws behind PR.PO-P10 and AIR-PREV-014

and 5 more, every one in the free file.

AIR-PREV-017AI Firewall Implementation and Management 15 10 13 in force, 2 not yet in force
The 15 laws behind PR.PO-P10 and AIR-PREV-017

and 5 more, every one in the free file.

AIR-PREV-020MCP Server Security Governance 15 10 13 in force, 2 not yet in force
The 15 laws behind PR.PO-P10 and AIR-PREV-020

and 5 more, every one in the free file.

AIR-DET-001AI Data Leakage Prevention and Detection 15 10 13 in force, 2 not yet in force
The 15 laws behind PR.PO-P10 and AIR-DET-001

and 5 more, every one in the free file.

AIR-DET-021Agent Decision Audit and Explainability 7 6 6 in force, 1 not yet in force
The 7 laws behind PR.PO-P10 and AIR-DET-021
AIR-DET-004AI System Observability 4 3 3 in force, 1 not yet in force
The 4 laws behind PR.PO-P10 and AIR-DET-004
AIR-PREV-005System Acceptance Testing 2 2 1 in force, 1 not yet in force
The 2 laws behind PR.PO-P10 and AIR-PREV-005
AIR-PREV-006Data Quality & Classification/Sensitivity 2 2 1 in force, 1 not yet in force
The 2 laws behind PR.PO-P10 and AIR-PREV-006
AIR-PREV-024Human-in-the-Loop Action Approval Gate 2 2 1 in force, 1 not yet in force
The 2 laws behind PR.PO-P10 and AIR-PREV-024
AIR-DET-011Human Feedback Loop for AI Systems 2 2 1 in force, 1 not yet in force
The 2 laws behind PR.PO-P10 and AIR-DET-011
PR.AC-P1Identities and credentials are issued, managed, verified, revoked, and audited for... AIR-PREV-007Legal and Contractual Frameworks for AI Systems 5 5 5 in force
The 5 laws behind PR.AC-P1 and AIR-PREV-007
AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems 5 5 5 in force
The 5 laws behind PR.AC-P1 and AIR-PREV-008
AIR-PREV-012Role-Based Access Control for AI Data 5 5 5 in force
The 5 laws behind PR.AC-P1 and AIR-PREV-012
AIR-PREV-014Encryption of AI Data at Rest 5 5 5 in force
The 5 laws behind PR.AC-P1 and AIR-PREV-014
AIR-PREV-017AI Firewall Implementation and Management 5 5 5 in force
The 5 laws behind PR.AC-P1 and AIR-PREV-017
AIR-PREV-020MCP Server Security Governance 5 5 5 in force
The 5 laws behind PR.AC-P1 and AIR-PREV-020
AIR-DET-001AI Data Leakage Prevention and Detection 5 5 5 in force
The 5 laws behind PR.AC-P1 and AIR-DET-001
PR.AC-P2Physical access to data and devices is managed. AIR-PREV-007Legal and Contractual Frameworks for AI Systems 2 2 2 in force
The 2 laws behind PR.AC-P2 and AIR-PREV-007
AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems 2 2 2 in force
The 2 laws behind PR.AC-P2 and AIR-PREV-008
AIR-PREV-012Role-Based Access Control for AI Data 2 2 2 in force
The 2 laws behind PR.AC-P2 and AIR-PREV-012
AIR-PREV-014Encryption of AI Data at Rest 2 2 2 in force
The 2 laws behind PR.AC-P2 and AIR-PREV-014
AIR-PREV-017AI Firewall Implementation and Management 2 2 2 in force
The 2 laws behind PR.AC-P2 and AIR-PREV-017
AIR-PREV-020MCP Server Security Governance 2 2 2 in force
The 2 laws behind PR.AC-P2 and AIR-PREV-020
AIR-DET-001AI Data Leakage Prevention and Detection 2 2 2 in force
The 2 laws behind PR.AC-P2 and AIR-DET-001
PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of... AIR-PREV-007Legal and Contractual Frameworks for AI Systems 20 15 20 in force
The 20 laws behind PR.AC-P4 and AIR-PREV-007

and 10 more, every one in the free file.

AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems 20 15 20 in force
The 20 laws behind PR.AC-P4 and AIR-PREV-008

and 10 more, every one in the free file.

AIR-PREV-012Role-Based Access Control for AI Data 20 15 20 in force
The 20 laws behind PR.AC-P4 and AIR-PREV-012

and 10 more, every one in the free file.

AIR-PREV-014Encryption of AI Data at Rest 20 15 20 in force
The 20 laws behind PR.AC-P4 and AIR-PREV-014

and 10 more, every one in the free file.

AIR-PREV-017AI Firewall Implementation and Management 20 15 20 in force
The 20 laws behind PR.AC-P4 and AIR-PREV-017

and 10 more, every one in the free file.

AIR-PREV-020MCP Server Security Governance 20 15 20 in force
The 20 laws behind PR.AC-P4 and AIR-PREV-020

and 10 more, every one in the free file.

AIR-DET-001AI Data Leakage Prevention and Detection 20 15 20 in force
The 20 laws behind PR.AC-P4 and AIR-DET-001

and 10 more, every one in the free file.

AIR-PREV-006Data Quality & Classification/Sensitivity 3 3 3 in force
The 3 laws behind PR.AC-P4 and AIR-PREV-006
AIR-DET-004AI System Observability 3 3 3 in force
The 3 laws behind PR.AC-P4 and AIR-DET-004
AIR-DET-021Agent Decision Audit and Explainability 3 3 3 in force
The 3 laws behind PR.AC-P4 and AIR-DET-021
AIR-PREV-005System Acceptance Testing 2 2 2 in force
The 2 laws behind PR.AC-P4 and AIR-PREV-005
AIR-PREV-018Agent Authority Least Privilege Framework 2 2 2 in force
The 2 laws behind PR.AC-P4 and AIR-PREV-018
AIR-PREV-023Agentic System Credential Protection Framework 2 2 2 in force
The 2 laws behind PR.AC-P4 and AIR-PREV-023
AIR-PREV-024Human-in-the-Loop Action Approval Gate 2 2 2 in force
The 2 laws behind PR.AC-P4 and AIR-PREV-024
AIR-DET-011Human Feedback Loop for AI Systems 2 2 2 in force
The 2 laws behind PR.AC-P4 and AIR-DET-011
PR.AC-P6Individuals and devices are proofed and bound to credentials, and authenticated... AIR-PREV-007Legal and Contractual Frameworks for AI Systems 3 2 3 in force
The 3 laws behind PR.AC-P6 and AIR-PREV-007
AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems 3 2 3 in force
The 3 laws behind PR.AC-P6 and AIR-PREV-008
AIR-PREV-012Role-Based Access Control for AI Data 3 2 3 in force
The 3 laws behind PR.AC-P6 and AIR-PREV-012
AIR-PREV-014Encryption of AI Data at Rest 3 2 3 in force
The 3 laws behind PR.AC-P6 and AIR-PREV-014
AIR-PREV-017AI Firewall Implementation and Management 3 2 3 in force
The 3 laws behind PR.AC-P6 and AIR-PREV-017
AIR-PREV-020MCP Server Security Governance 3 2 3 in force
The 3 laws behind PR.AC-P6 and AIR-PREV-020
AIR-DET-001AI Data Leakage Prevention and Detection 3 2 3 in force
The 3 laws behind PR.AC-P6 and AIR-DET-001
PR.DS-P1Data-at-rest are protected. AIR-PREV-007Legal and Contractual Frameworks for AI Systems 8 8 8 in force
The 8 laws behind PR.DS-P1 and AIR-PREV-007
AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems 8 8 8 in force
The 8 laws behind PR.DS-P1 and AIR-PREV-008
AIR-PREV-012Role-Based Access Control for AI Data 8 8 8 in force
The 8 laws behind PR.DS-P1 and AIR-PREV-012
AIR-PREV-014Encryption of AI Data at Rest 8 8 8 in force
The 8 laws behind PR.DS-P1 and AIR-PREV-014
AIR-PREV-017AI Firewall Implementation and Management 8 8 8 in force
The 8 laws behind PR.DS-P1 and AIR-PREV-017
AIR-PREV-020MCP Server Security Governance 8 8 8 in force
The 8 laws behind PR.DS-P1 and AIR-PREV-020
AIR-DET-001AI Data Leakage Prevention and Detection 8 8 8 in force
The 8 laws behind PR.DS-P1 and AIR-DET-001
PR.DS-P2Data-in-transit are protected. AIR-PREV-007Legal and Contractual Frameworks for AI Systems 12 12 12 in force
The 12 laws behind PR.DS-P2 and AIR-PREV-007

and 2 more, every one in the free file.

AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems 11 11 11 in force
The 11 laws behind PR.DS-P2 and AIR-PREV-008

and 1 more, every one in the free file.

AIR-PREV-012Role-Based Access Control for AI Data 11 11 11 in force
The 11 laws behind PR.DS-P2 and AIR-PREV-012

and 1 more, every one in the free file.

AIR-PREV-014Encryption of AI Data at Rest 11 11 11 in force
The 11 laws behind PR.DS-P2 and AIR-PREV-014

and 1 more, every one in the free file.

AIR-PREV-017AI Firewall Implementation and Management 11 11 11 in force
The 11 laws behind PR.DS-P2 and AIR-PREV-017

and 1 more, every one in the free file.

AIR-PREV-020MCP Server Security Governance 11 11 11 in force
The 11 laws behind PR.DS-P2 and AIR-PREV-020

and 1 more, every one in the free file.

AIR-DET-001AI Data Leakage Prevention and Detection 11 11 11 in force
The 11 laws behind PR.DS-P2 and AIR-DET-001

and 1 more, every one in the free file.
PR.DS-P3Systems/products/services and associated data are formally managed throughout removal,... AIR-DET-004AI System Observability 2 2 2 in force
The 2 laws behind PR.DS-P3 and AIR-DET-004
AIR-DET-021Agent Decision Audit and Explainability 2 2 2 in force
The 2 laws behind PR.DS-P3 and AIR-DET-021
PR.DS-P5Protections against data leaks are implemented. AIR-PREV-007Legal and Contractual Frameworks for AI Systems 125 105 113 in force, 8 not yet in force, 4 proposed
The 125 laws behind PR.DS-P5 and AIR-PREV-007

and 115 more, every one in the free file.

AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems 124 105 112 in force, 8 not yet in force, 4 proposed
The 124 laws behind PR.DS-P5 and AIR-PREV-008

and 114 more, every one in the free file.

AIR-PREV-012Role-Based Access Control for AI Data 124 105 112 in force, 8 not yet in force, 4 proposed
The 124 laws behind PR.DS-P5 and AIR-PREV-012

and 114 more, every one in the free file.

AIR-PREV-014Encryption of AI Data at Rest 124 105 112 in force, 8 not yet in force, 4 proposed
The 124 laws behind PR.DS-P5 and AIR-PREV-014

and 114 more, every one in the free file.

AIR-PREV-017AI Firewall Implementation and Management 124 105 112 in force, 8 not yet in force, 4 proposed
The 124 laws behind PR.DS-P5 and AIR-PREV-017

and 114 more, every one in the free file.

AIR-PREV-020MCP Server Security Governance 124 105 112 in force, 8 not yet in force, 4 proposed
The 124 laws behind PR.DS-P5 and AIR-PREV-020

and 114 more, every one in the free file.

AIR-DET-001AI Data Leakage Prevention and Detection 124 105 112 in force, 8 not yet in force, 4 proposed
The 124 laws behind PR.DS-P5 and AIR-DET-001

and 114 more, every one in the free file.

AIR-DET-021Agent Decision Audit and Explainability 12 12 11 in force, 1 proposed
The 12 laws behind PR.DS-P5 and AIR-DET-021

and 2 more, every one in the free file.

AIR-DET-004AI System Observability 10 10 9 in force, 1 proposed
The 10 laws behind PR.DS-P5 and AIR-DET-004
AIR-PREV-005System Acceptance Testing 9 9 9 in force
The 9 laws behind PR.DS-P5 and AIR-PREV-005
AIR-PREV-006Data Quality & Classification/Sensitivity 9 9 9 in force
The 9 laws behind PR.DS-P5 and AIR-PREV-006
AIR-PREV-024Human-in-the-Loop Action Approval Gate 6 6 6 in force
The 6 laws behind PR.DS-P5 and AIR-PREV-024
AIR-DET-011Human Feedback Loop for AI Systems 6 6 6 in force
The 6 laws behind PR.DS-P5 and AIR-DET-011
Not connected to the FINOS AIGF: 53 of NIST Privacy Framework's controls

Short of 2 laws

The same duties reach these and a FINOS AIGF control, in fewer than 2 of the laws we track.

No FINOS AIGF control on the same duties

Laws reach these, but no duty that reaches one of them also reaches a FINOS AIGF control.

  • ID.IM-P2 Owners or operators (e.g., the organization or third parties such as service..., 2 laws
  • ID.BE-P1 The organization’s role(s) in the data processing ecosystem are identified and communicated., 3 laws
  • ID.BE-P3 Systems/products/services that support organizational priorities are identified and..., 1 law
  • ID.DE-P1 Data processing ecosystem risk management policies, processes, and procedures are..., 1 law
  • ID.DE-P5 Data processing ecosystem parties are routinely assessed using audits, test results,..., 7 laws
  • GV.AT-P3 Privacy personnel understand their roles and responsibilities., 1 law
  • GV.MT-P1 Privacy risk is re-evaluated on an ongoing basis and as key factors, including the..., 2 laws
  • GV.MT-P5 Policies, processes, and procedures are established and in place to receive, analyze,..., 3 laws
  • CT.DM-P7 Mechanisms for transmitting processing permissions and related data values with data..., 1 law
  • CT.DP-P1 Data are processed to limit observability and linkability (e.g., data actions take..., 8 laws
  • CT.DP-P5 Attribute references are substituted for attribute values., 1 law
  • CM.AW-P2 Mechanisms for obtaining feedback from individuals (e.g., surveys or focus groups)..., 1 law
  • CM.AW-P8 Individuals are provided with mitigation mechanisms (e.g., credit monitoring, consent..., 5 laws
  • PR.PO-P1 A baseline configuration of information technology is created and maintained..., 1 law
  • PR.PO-P5 Protection processes are improved., 7 laws
  • PR.AC-P5 Network integrity is protected (e.g., network segregation, network segmentation)., 2 laws
  • PR.DS-P4 Adequate capacity to ensure availability is maintained., 1 law
  • PR.MA-P1 Maintenance and repair of organizational assets are performed and logged, with..., 1 law
  • PR.PT-P3 Communications and control networks are protected., 1 law
  • PR.PT-P4 Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve..., 6 laws

No law we track reaches these

No duty in the laws we track reaches these controls.

  • ID.IM-P3 Categories of individuals (e.g., customers, employees or prospective employees,...
  • ID.IM-P8 Data processing is mapped, illustrating the data actions and associated data elements...
  • ID.BE-P2 Priorities for organizational mission, objectives, and activities are established and...
  • ID.RA-P1 Contextual factors related to the systems/products/services and the data actions are...
  • ID.DE-P4 Interoperability frameworks or similar multi-party approaches are used to manage data...
  • GV.PO-P6 Governance and risk management policies, processes, and procedures address privacy risks.
  • GV.RM-P2 Organizational risk tolerance is determined and clearly expressed.
  • GV.RM-P3 The organization’s determination of risk tolerance is informed by its role(s) in the...
  • GV.AT-P2 Senior executives understand their roles and responsibilities.
  • GV.AT-P4 Third parties (e.g., service providers, customers, partners) understand their roles...
  • GV.MT-P2 Privacy values, policies, and training are reviewed and any updates are communicated.
  • CT.PO-P4 A data life cycle to manage data is aligned and implemented with the system...
  • CT.DP-P3 Data are processed to limit the formulation of inferences about individuals’ behavior...
  • CM.PO-P2 Roles and responsibilities (e.g., public relations) for communicating data processing...
  • PR.PO-P4 Policy and regulations regarding the physical operating environment for organizational...
  • PR.PO-P6 Effectiveness of protection technologies is shared.
  • PR.AC-P3 Remote access is managed.
  • PR.DS-P6 Integrity checking mechanisms are used to verify software, firmware, and information integrity.
  • PR.DS-P7 The development and testing environment(s) are separate from the production environment.
  • PR.DS-P8 Integrity checking mechanisms are used to verify hardware integrity.
  • PR.MA-P2 Remote maintenance of organizational assets is approved, logged, and performed in a...

Lines of the news aggregation laws we track were not read against the NIST Privacy Framework, so none of them connects the two here (how each subject's lines were read).

How these connections are drawn

Each requirement line in the laws we track is read against the framework for its subject (the AI, scraping and news aggregation laws against the NIST AI RMF, the privacy, communications and age assurance laws against the NIST Privacy Framework, the cybersecurity laws against the NIST CSF 2.0); laws on liability and content moderation are not read against any framework yet. A line reaches the FINOS AIGF through a kind of duty its law carries, and only where that kind of duty also reaches, on that same line, the NIST framework for the line's own subject. Two controls connect when lines in at least 2 laws reach both. That says the same duties reach both; it does not say the two are alike, or that running either one does what a law asks.

A line placed on a control in the framework for its own subject, whose law carries a kind of duty that reaches another of the three frameworks read line by line, is read against that one as well: every such line, or only those whose wording reaches into it. For these two:

Laws onRead against the NIST Privacy Framework
AIsuch lines on personal data and privacy, biometrics, likeness and identity, profiling, surveillance and consent
scrapingsuch lines on interception, monitoring, personal data and privacy
news aggregationnot read
cybersecurityevery such line

Every duty line in the AI, scraping, privacy, communications, age assurance and cybersecurity laws we track has been read against the framework for its subject.

Sources and licenses

FINOS AI Governance Framework, copyright 2025 FINOS, licensed under CC BY 4.0. Titles and purpose text are quoted; markdown emphasis and links were removed.