OWASP Agentic Top 10 ASI09Human-Agent Trust Exploitation

Intelligent agents can establish strong trust with human users through their natural language fluency, emotional intelligence, and perceived expertise, known as anthropomorphism. Adversaries or misaligned designs may exploit this trust to influence user decisions, extract sensitive information, or steer outcomes for malicious purposes. In agentic systems, this risk is amplified when humans over-rely on autonomous recommendations or unverifiable rationales, approving actions without independent validation. By leveraging authority bias and persuasive explainability, attackers can bypass oversight, leading to data breaches, financial losses, downstream and reputational harms.OWASP Top 10 for Agentic Applications, 2026 edition, December 2025, ASI09

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of 14 Nov 2026.

The kinds of duty that reach it: content labelling, design code, governance.

131: laws
62: jurisdictions
1: with court rulings behind it
39: not yet in force
1: blocked by a court
5: proposed, not law

Related controls in other frameworks the same duties, in at least two laws we track, reach both

NIST AI RMFMEASURE 2.8 Risks associated with transparency and accountability – as identified in the..., 56 laws
NIST AI RMFGOVERN 1.1 Legal and regulatory requirements involving AI are understood, managed, and..., 38 laws
NIST AI RMFMAP 3.5 Processes for human oversight are defined, assessed, and documented in..., 24 laws
16 more in the NIST AI RMF
NIST AI 600-1GAI-RISK-07 Human-AI Configuration, 131 laws
NIST AI 600-1GAI-RISK-08 Information Integrity, 57 laws
NIST AI 600-1GAI-RISK-09 Information Security, 14 laws
4 more in the NIST AI 600-1
NIST AI 200-22.3 Apply & Measure, 77 laws
NIST AI 200-24.3 Composing a TEVV Toolbox, 77 laws
OWASP LLM Top 10LLM03:2026 Excessive Agency, 77 laws
MIT mitigations4.1 System Documentation, 110 laws
MIT mitigations1.1 Board Structure & Oversight, 77 laws
MIT mitigations1.2 Risk Management, 77 laws
11 more in the MIT mitigations
NIST Privacy FrameworkCT.PO-P1 Policies, processes, and procedures for authorizing data processing (e.g.,..., 4 laws
NIST Privacy FrameworkCM.AW-P1 Mechanisms (e.g., notices, internal or public reports) for communicating..., 4 laws
NIST Privacy FrameworkID.RA-P2 Data analytic inputs and outputs are identified and evaluated for bias., 3 laws
5 more in the NIST Privacy Framework
NIST CSF 2.0PR.PS-04 Log records are generated and made available for continuous monitoring, 8 laws
FINOS AIGFAIR-DET-021 Agent Decision Audit and Explainability, 110 laws
FINOS AIGFAIR-DET-004 AI System Observability, 78 laws
FINOS AIGFAIR-PREV-005 System Acceptance Testing, 77 laws
4 more in the FINOS AIGF
ETSI EN 304 2235.1.4-1 Capability for human oversight designed in and maintained., 77 laws
ETSI EN 304 2235.2.1-1 Full inventory of assets, including their dependencies and connections., 77 laws
ETSI EN 304 2235.2.4-1 Developers keep an audit trail of system design and post-deployment..., 77 laws
7 more in the ETSI EN 304 223

A law in force is unmarked; the rest wear their state: not yet in force blocked by a court proposed

AI transparency

55 laws, 41 jurisdictions

Jurisdiction	Law	How it reaches this control
Alabama	Distribution of Materially Deceptive Media to Influence an Upcoming Election	Through its content labelling duty. What it requires
Brazil	TSE Resolution, AI-Generated Content Disclosure Duty	Through its content labelling duty. What it requires
California	AB 2839, election materially deceptive deepfake disclaimer law blocked by a court	Through its content labelling duty. What it requires
California	AB 730, as extended by AB 972, election deepfake disclosure law	Through its content labelling duty. What it requires
California	California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713)	Through its content labelling duty. What it requires
California	Synthetic Performer Advertising Disclosure Act (SB 1050) from 1 Jan 2027, in 7 weeks	Through its content labelling duty. What it requires
China	Measures for Labeling AI-Generated Synthetic Content	Through its content labelling duty. What it requires
Colorado	HB 24-1147, Candidate Election Deepfake Disclosures	Through its content labelling duty. What it requires
Colorado	HB 26-1263 (2026), Conversational AI Service Operator Requirements	Through its content labelling, design code duties. What it requires
Connecticut	Generative AI Content Provenance Duty for Large Providers	Through its content labelling duty. What it requires

Show the other 45 laws

Croatia	Act Implementing the European Media Freedom Act, Article 23, Labelling of AI-Generated Content	Through its content labelling duty. What it requires
European Union	AI Act, Article 50 (transparency obligations for AI systems and synthetic content)	Through its content labelling duty. What it requires
European Union	Digital Services Act, Article 35(1)(k) (systemic risk mitigation, synthetic media marking)	Through its content labelling duty. What it requires
European Union	European Commission Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of the AI Act from a date not yet set	Through its content labelling duty. What it requires
Florida	AI Use in Political Advertising Disclosure Requirement (HB 919, 2024)	Through its content labelling duty. What it requires
France	Law 2023-451, Article 5, Labelling of Retouched and AI-Generated Images by Commercial Influencers	Through its content labelling duty. What it requires
Gabon	Ordonnance n°0011/PR/2026, marquage des contenus générés par intelligence artificielle	Through its content labelling duty. What it requires
Greece	Law 5321/2026, National AI Act Implementation Law	Through its content labelling duty. What it requires
Idaho	Conversational AI Safety Act from 1 Jul 2027, in 8 months	Through its content labelling, design code duties. What it requires
Idaho	FAIR Elections Act, disclosure duty for synthetic media in electioneering communications	Through its content labelling duty. What it requires
Indiana	Use of Digitally Altered Media in Elections (House Enrolled Act 1133, 2024)	Through its content labelling duty. What it requires
Iowa	Conversational AI Services Act (Senate File 2417) from 1 Jul 2027, in 8 months	Through its content labelling, design code duties. What it requires
Jamaica	Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings	Through its governance duty. What it requires
Japan	Public Offices Election Act, AI-Generated Content Labelling Duty (2026 Amendment) from 1 Mar 2027, in 4 months	Through its content labelling duty. What it requires
Kazakhstan	Law on Artificial Intelligence, transparency and disclosure duties	Through its content labelling duty. What it requires
Kentucky	Synthetic Media Disclosure in Electioneering Communications	Through its content labelling duty. What it requires
Kyrgyzstan	Digital Code, Chapter 23: AI interaction and deepfake disclosure duties	Through its content labelling duty. What it requires
Latvia	Pre-Election Campaigning Law, Articles 3.1 and 31.1, Indicating AI-Generated Campaign Content and the Ban on Further Distribution	Through its content labelling duty. What it requires
Louisiana	Act 559 (HB 639), AI-generated voice telephone campaign communication disclosure	Through its content labelling duty. What it requires
Louisiana	Act 806 (HB 459), AI-manipulated electioneering communication disclosure	Through its content labelling duty. What it requires
Massachusetts	An Act enhancing disclosure requirements for synthetic media in political advertising (H.5094) proposed	Through its content labelling duty. What it requires
Michigan	AI-Generated Political Advertisement and Robocall Disclosure (Public Act 263 of 2023)	Through its content labelling duty. What it requires
Michigan	Distribution of Materially Deceptive Election Media (Public Act 265 of 2023)	Through its content labelling duty. What it requires
Nebraska	Conversational Artificial Intelligence Safety Act (LB 525, §§ 12-18) from 1 Jul 2027, in 8 months	Through its content labelling duty. What it requires
Nevada	AB 73 (2025), AI-manipulated media disclosure in paid political communications	Through its content labelling duty. What it requires
New Mexico	HB 182 (2024), AI-generated and manipulated media disclosure and disclaimer requirements in campaign advertising	Through its content labelling duty. What it requires
New York	Disclosure of materially deceptive AI-generated media in political communications	Through its content labelling duty. What it requires
New York	Synthetic Performer Advertising Disclosure Law	Through its content labelling duty. What it requires
North Dakota	House Bill 1167 (2025), AI-generated political content disclosure	Through its content labelling duty. What it requires
Ohio	S.B. 163, AI-Generated Content Watermark and Provenance Mandate proposed	Through its content labelling duty. What it requires
Oregon	AI Companion Chatbot Safety Act (SB 1546) from 1 Jan 2027, in 7 weeks	Through its content labelling, design code duties. What it requires
Oregon	Campaign communication disclosure of synthetic media (SB 1571)	Through its content labelling duty. What it requires
Pennsylvania	S.B. 806, Artificial Intelligence Deceptive Advertising Act from 21 Dec 2026, in 5 weeks	Through its content labelling duty. What it requires
Puerto Rico	AI disclosure in political advertising and electoral communications	Through its content labelling duty. What it requires
Russia	Federal Law No. 243-FZ, Article 9, AI-Generated Content Notice from 1 Mar 2027, in 4 months	Through its content labelling duty. What it requires
Slovenia	Media Act (ZMed-1), Articles 66 and 67, Labelling of AI-Generated Media Content and Publisher Responsibility	Through its content labelling duty. What it requires
Turkey	Commercial Advertising Regulation, AI Disclosure Duty	Through its content labelling duty. What it requires
United States	AI Labeling Act of 2026 proposed	Through its content labelling duty. What it requires
United States	FCC AI Political Ad Disclosure Rulemaking, Docket 24-211 proposed	Through its content labelling duty. What it requires
Utah	Digital Content Provenance Standards Act (HB 276, 2026 General Session), Utah Code Title 13 Chapter 72c from 1 Jan 2027, in 7 weeks	Through its content labelling duty. What it requires
Vietnam	Law on Artificial Intelligence, transparency obligation	Through its content labelling duty. What it requires
Washington	AI companion chatbot disclosure and safety act from 1 Jan 2027, in 7 weeks	Through its content labelling duty. What it requires
Washington	AI content provenance and disclosure act from 1 Feb 2027, in 3 months	Through its content labelling duty. What it requires
Washington	Synthetic media in electioneering communications	Through its content labelling duty. What it requires
Wisconsin	2023 Wisconsin Act 123, AI-Generated Content Disclosure in Political Communications	Through its content labelling duty. What it requires

AI sector rules

27 laws, 16 jurisdictions

Jurisdiction	Law	How it reaches this control
Alabama	SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization	Through its governance duty. What it requires
California	Employment Automated Decision Systems Act (SB 947) from 1 Jul 2027, in 8 months	Through its governance duty. What it requires
California	Health Care Services Artificial Intelligence Act (AB 1979) from 1 Jan 2027, in 7 weeks	Through its governance duty. What it requires
Canada	CSA Staff Notice 31-342, guidance for portfolio managers regarding online advice	Through its governance duty. What it requires
Canada	OSFI Guideline E-23, Enterprise-Wide Model Risk Management for Deposit-Taking Institutions (2017)	Through its governance duty. What it requires
Canada	OSFI Guideline E-23, Model Risk Management (2027) from 1 May 2027, in 6 months	Through its governance duty. What it requires
Colorado	Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models	Through its governance duty. What it requires
European Union	EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance	Through its governance duty. What it requires
European Union	MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6)	Through its governance duty. What it requires
European Union	MiFID II Suitability Assessment for Investment Advice and Portfolio Management, Including Automated and Semi-Automated Systems (Article 25(2) and Delegated Regulation 2017/565 Article 54)	Through its governance duty. What it requires

Show the other 17 laws

Georgia	Private Review Agent Artificial Intelligence Coverage Determinations Act (SB 444) from 1 Jan 2027, in 7 weeks	Through its governance duty. What it requires
Jordan	Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0	Through its governance duty. What it requires
Mauritius	Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021	Through its governance duty. What it requires
Mauritius	FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services	Through its governance duty. What it requires
Michigan	Michigan DIFS Bulletin 2026-03-BT/CF/CU, Use of Artificial Intelligence Systems by Financial Service Providers	Through its governance duty. What it requires
Minnesota	Utilization Review, AI-Only Adverse Determination Prohibition from 1 Jan 2027, in 7 weeks	Through its governance duty. What it requires
Nevada	AB 406 (2025), licensed provider restriction on direct clinical use of AI	Through its governance duty. What it requires
Saudi Arabia	Counter-Fraud Framework: fraud detection systems, machine learning and artificial intelligence	Through its governance duty. What it requires
United Arab Emirates	Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E.	Through its governance duty. What it requires
United Arab Emirates	Model Management Standards: governance, validation and monitoring of the models a bank uses to decide, including artificial intelligence models	Through its governance duty. What it requires
United Kingdom	Artificial Intelligence (AI) update	Through its governance duty. What it requires
United Kingdom	Model risk management principles for banks	Through its governance duty. What it requires
United Kingdom	Suitability for MiFID business: personal recommendations and decisions to trade, including advice given through an automated or semi-automated system	Through its governance duty. What it requires
United States	FINRA Regulatory Notice 24-09, FINRA reminds members of regulatory obligations when using generative artificial intelligence and large language models	Through its governance duty. What it requires
United States	Interagency Statement on the Use of Alternative Data in Credit Underwriting	Through its governance duty. What it requires
United States	Interagency Supervisory Guidance on Model Risk Management (2026 revision)	Through its governance duty. What it requires
Utah	Health Insurance Preauthorization AI Disclosure (SB 319, 2026 General Session) from 1 Jan 2027, in 7 weeks	Through its governance duty. What it requires

AI risk obligations

25 laws, 11 jurisdictions

Jurisdiction	Law	How it reaches this control
California	Clinical Decision Support Systems Bias Mitigation Act (SB 503) from 1 Jan 2027, in 7 weeks	Through its governance duty. What it requires
Colorado	HB 26-1139 (2026), Use of Artificial Intelligence in Health Care from 1 Jan 2027, in 7 weeks	Through its governance duty. What it requires
El Salvador	Resolución ANIA 0001/2025, registro obligatorio para decisiones consecuenciales	Through its governance duty. What it requires
European Union	AI Act, Article 10 (data and data governance) from 2 Dec 2027, in 13 months	Through its governance duty. What it requires
European Union	AI Act, Article 111(2) (2030 compliance deadline for public-authority-intended systems) from 2 Aug 2030, in 3.7 years	Through its governance duty. What it requires
European Union	AI Act, Article 14 (human oversight) from 2 Dec 2027, in 13 months	Through its governance duty. What it requires
European Union	AI Act, Article 16 (obligations of providers of high-risk AI systems) from 2 Dec 2027, in 13 months	Through its governance duty. What it requires
European Union	AI Act, Article 17 (quality management system) from 2 Dec 2027, in 13 months	Through its governance duty. What it requires
European Union	AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring) from 2 Dec 2027, in 13 months	Through its governance duty. What it requires
European Union	AI Act, Article 26(10) (post-remote biometric identification authorisation) from 2 Dec 2027, in 13 months	Through its governance duty. What it requires

Show the other 15 laws

European Union	AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties) from 2 Dec 2027, in 13 months	Through its governance duty. What it requires
European Union	AI Act, Article 6(3) and (4) (narrow-task derogation from Annex III high-risk classification) from 2 Dec 2027, in 13 months	Through its governance duty. What it requires
European Union	AI Act, Article 72 (post-market monitoring by providers and post-market monitoring plan) from 2 Dec 2027, in 13 months	Through its governance duty. What it requires
European Union	AI Act, Article 9 (risk management system) from 2 Dec 2027, in 13 months	Through its governance duty. What it requires
European Union	AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent)	Through its governance duty. What it requires
Indiana	Downcoding of Health Benefits Claims, automated and AI decision-making (House Enrolled Act 1271, 2026)	Through its governance duty. What it requires
Italy	Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them	Through its governance duty. What it requires
Italy	Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10)	Through its governance duty. What it requires
Italy	Decreto Legislativo 160/2026, Police Use of AI Systems: Human Review, Oversight, Collaborations, Sandbox Basis and Training (Artt. 3-6, 21)	Through its governance duty. What it requires
Kyrgyzstan	Digital Code, Chapter 23: AI system design and risk-management obligations	Through its governance duty. What it requires
Malta	Artificial Intelligence (Designation of the Information and Data Protection Commissioner for the purposes of Regulation (EU) 2024/1689) Regulations, 2025 (L.N. 227 of 2025)	Through its governance duty. What it requires
Malta	Artificial Intelligence Regulations, 2025 (L.N. 226 of 2025)	Through its governance duty. What it requires
Montana	Right to Compute Act (SB 212, 2025), critical AI infrastructure risk management duty	Through its governance duty. What it requires
South Korea	AI Framework Act, Article 34 (business-operator duties for high-impact AI)	Through its governance duty. What it requires
Vietnam	Law on Artificial Intelligence, risk classification and conformity assessment	Through its governance duty. What it requires

AI governance

21 laws, 14 jurisdictions

Jurisdiction	Law	How it reaches this control
California	Transparency in Frontier Artificial Intelligence Act (SB 53)	Through its governance duty. What it requires
European Union	AI Act, Article 12 (record-keeping) from 2 Dec 2027, in 13 months	Through its governance duty. What it requires
European Union	AI Act, Article 18 (documentation keeping) from 2 Dec 2027, in 13 months	Through its governance duty. What it requires
European Union	AI Act, Article 19 (automatically generated logs) from 2 Dec 2027, in 13 months	Through its governance duty. What it requires
European Union	AI Act, Article 21(2) (competent authority access to automatically generated logs) from 2 Dec 2027, in 13 months	Through its governance duty. What it requires
European Union	AI Act, Article 22(3), points (b) and (c) (authorised representative: documents held for 10 years and access to logs) from 2 Dec 2027, in 13 months	Through its governance duty. What it requires
European Union	AI Act, Article 26(6) (deployer log-keeping) from 2 Dec 2027, in 13 months	Through its governance duty. What it requires
European Union	Commission Guidelines on the scope of the obligations for providers of general-purpose AI models under the AI Act	Through its governance duty. What it requires
Finland	Laki eräiden tekoälyjärjestelmien valvonnasta, Act on the Supervision of Certain Artificial Intelligence Systems	Through its governance duty. What it requires
Germany	Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act	Through its governance duty. What it requires

Show the other 11 laws

Hungary	Act LXXV of 2025 on the Domestic Implementation of the EU AI Regulation	Through its governance duty. What it requires
Hungary	Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings	Through its governance duty. What it requires
Illinois	Artificial Intelligence Safety Measures Act from 1 Jan 2027, in 7 weeks	Through its governance duty. What it requires
Latvia	Law on Digital Operational Resilience of the Financial Market and the Use of Artificial Intelligence, Articles 7, 8(5)-(7), 10(3)-(4) and 11(2)	Through its governance duty. What it requires
Malta	Malta Digital Innovation Authority Act, Article 6A, Market Surveillance Enforcement Powers of the Authority	Through its governance duty. What it requires
Poland	Ustawa o systemach sztucznej inteligencji, Act on Artificial Intelligence Systems	Through its governance duty. What it requires
Russia	Federal Law No. 243-FZ, Article 8, Duties of Sovereign and National Foundation Model Developers from 1 Mar 2027, in 4 months	Through its governance duty. What it requires
Slovenia	Zakon o izvajanju uredbe (EU) o določitvi harmoniziranih pravil o umetni inteligenci (ZIUDHPUI), Designation of AI Act Market Surveillance Authorities	Through its governance duty. What it requires
United States	Artificial Intelligence Risk Management and Security Act of 2026 proposed	Through its governance duty. What it requires
Vanuatu	Digital Transformation Act 2025, ICT service permit for AI and AI-related data services	Through its governance duty. What it requires
Vatican City	Guidelines on Artificial Intelligence of Vatican City State (Decree No. DCCII)	Through its content labelling, governance duties. What it requires

AI prohibited practices

2 laws, 2 jurisdictions

Jurisdiction	Law	How it reaches this control
Denmark	Lov nr. 467 af 14. maj 2025, National Competent Authorities and Article 5 Enforcement	Through its governance duty. What it requires
Italy	Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13)	Through its governance duty. What it requires

AI training data

1 law, 1 jurisdiction

Jurisdiction	Law	How it reaches this control
European Union	AI Act, Article 53 (obligations for providers of general-purpose AI models)	Through its governance duty. What it requires

Excerpts of the OWASP Top 10 for Agentic Applications, CC BY-SA 4.0. OWASP GenAI Security Project, Agentic Security Initiative, OWASP Top 10 for Agentic Applications 2026, licensed CC BY-SA 4.0. Excerpted: only the first paragraph of each entry's Description is reproduced, verbatim. Every control of the framework.