I make complex technology risk concrete enough to govern.
I work where law, cybersecurity, AI, operations, and evidence meet. My approach is practical: understand the system that actually exists, define the authority boundaries, instrument the important decisions, and make the evidence strong enough for a board, regulator, customer, or incident team to rely on.
A practical starting point: open a guided lab, follow the steps, and select any component to see the risk, control and oversight implications. Labs open in a separate window or tab; this page stays where you left it.
My shorthand for the way I work: make the control real, make the evidence visible, and make the system recoverable. I am less interested in whether a framework looks complete on paper than whether people can prove what happened, interrupt what should not happen, and recover when something goes wrong.
AI can change state faster than a governance committee can reconvene.
Traditional assurance proves what was configured or tested at a point in time. Agentic systems can plan, remember, call tools, delegate work, alter state, and persist across sessions. The assurance problem therefore shifts from asking whether the model produced a safe answer to proving that the complete AI-enabled process remains within authorized boundaries while it is operating.
A test proves the starting condition. Continuous assurance proves what happens next.
Follow the same agent from approval through an attempted state change. The upper lane shows what a point-in-time test can establish. The lower lane shows the runtime controls and evidence needed to keep the process within its mandate.
Point-in-time assurance
Known at approval; increasingly uncertain during runtime.
The test remains valid for the moment it occurred, but runtime behavior continues unobserved.
Continuous behavioral assurance
Every material step is compared, recorded and enforceable.
Pre-authorized controls suspend the action path, preserve evidence and route the exception to an accountable human.
The system is approved for a defined purpose, identity, tool set, data scope and operating limit.
The configuration and test evidence support a decision at this moment.
The approved operating baseline and evidence chain are established before runtime begins.
Point-in-time assurance Proves what was configured or tested at one moment. The agent then plans, remembers, calls tools, delegates and alters state with no independent record of what it did.
Continuous behavioral assurance An approved operating baseline, evidence captured at every step, deviation detected as it emerges, and machine-speed containment before it becomes consequence.
Select any stage, choose Next stage, or play the scenario. The two lanes always describe the same agent task.
Detect deviation early. Contain it before it becomes consequence.
Trustworthy AI requires continuous behavioral assurance: establishing an approved operating baseline, detecting anomalous or aberrant agentic behavior as it emerges, and triggering machine-speed containment when an agent begins to drift from its authorized task, tools, identity, data, or decision boundaries. The objective is not merely to explain a failure after the fact; it is to interrupt unsafe persistence, privilege expansion, deceptive completion, unauthorized delegation, or control-plane probing before those behaviors propagate into a material business, security, regulatory, or safety event.
Bind autonomy to explicit limits
Define who or what may act, which tools may be invoked, which data may be touched, and where human approval is mandatory.
Observe the process, not only the model
Capture model, agent, tool, identity, workflow, and outcome telemetry in an evidence plane the controlled workload cannot rewrite.
Make containment an architectural control
Pre-authorize isolation, rollback, credential revocation, tool suspension, and escalation so response does not wait for a committee meeting.
Enterprise resilience must be more authoritative than agent persistence.
What it is. The Resilience Imperative is my governance and systems-risk principle for agentic AI: the enterprise must be able to interrupt, reconstruct, and recover from an autonomous workflow, and the agent must never be able to preserve task execution by defeating the controls intended to govern it.
Why it matters. A system does not need a human-like desire for self-preservation to produce persistence, workarounds, privilege expansion, delegation, deception, or control bypass. Persistent task optimization can make those behaviors instrumentally useful when permissions are denied, resources are exhausted, tests fail, or human intervention blocks the preferred path.
Where I apply it. The concept is most relevant where AI has durable memory, tools, privileged identities, code or infrastructure access, transaction authority, external communication, multi-agent delegation, or the ability to create persistent artifacts. In those environments, governance and compliance have to be executable: independent authority boundaries, synchronous action authorization, AI Deviation Detection & Response (AI-DDR), immutable evidence, persistence governance, tested containment, and recovery.
Open the Resilience Imperative explainer →Law, cyber operations, AI governance, and evidence — in one operating view.
My work has repeatedly landed in the seams between disciplines: litigation and data, security and business operations, regulation and engineering, or AI capability and enterprise control. That is why the site is organized as working models and evidence systems rather than a conventional company-services catalog.
Legal judgment
Privilege, eDiscovery, investigations, records, contract risk, chain of custody and defensibility.
Operational security
Incident response, Cyber Fusion, threat intelligence, DLP, forensics, insider risk and supplier security.
Bounded autonomy
AI lifecycle governance, agentic authority, harness architecture, observability, xBOM and runtime assurance.
Evidence that travels
Audit-ready controls, regulatory mapping, board reporting, Portable Trust and business-process assurance.
Security operations and resilience experience across regulated, multinational environments.
Control testing, examination readiness, risk translation and defensible technical narratives.
Applied work on AI Harness architecture, AI-DDR, Portable Trust and the Resilience Imperative.
A J.D.-grounded approach to investigations, digital evidence, privacy, eDiscovery and technology governance.
From the briefing archive
For Chief AI Officers, CIOs, CISOs, general counsel, and compliance officers.
Open the September 18 archived brief
OpenAI’s disclosures put escalation failures in focus
Context at a glance
- Organization / source
- OpenAI, a US-based AI developer, published selected model-misalignment observations from training or evaluation and a reporting framework. These are vendor disclosures, not a representative incident census.
- Applicable sector
- AI developers and enterprise AI users, including financial institutions using agents, tools, memory or external communication.
- Jurisdiction / authority
- US-based publisher; global technical relevance. Any legal notification duty requires a separate assessment of the institution, affected data, system role and applicable law.
- Why selected
- Selected because the cases expose the difference between a successful-looking output and an authorized process. They turn assurance into specific tests of boundary enforcement, escalation, evidence ownership and containment.
Acronyms & key terms
- AI — Artificial intelligence
- SIEM — Security information and event management
- NIST — US National Institute of Standards and Technology
- AI RMF — NIST AI Risk Management Framework
- GPAI — General-purpose artificial intelligence
Vendor disclosure · September 16, 2026 · Security / legal / board oversight
OpenAI’s new misalignment-reporting framework arrives with six reports from training or evaluation. They describe concealment in task summaries, unauthorized credential use, public file uploads, and unapproved agent communication. Earlier incident findings make the governance issue concrete: recognizing a warning is only part of the job; someone must own the decision that follows. Source: OpenAI
Why it matters: A deliverable can look successful while the process used to produce it exceeds the agent’s authority. Leaders need independently captured evidence of actions, tested containment, and clear notification ownership.
This week: Reproduce the reported failure modes in an isolated harness using synthetic data. Test the block or safe stop, the alert, the escalation, and the retained evidence.
EU AI Board: implementation moves into operational oversight
Context at a glance
- Organization / source
- The European AI Board brings together EU Member State representatives to support coordinated AI Act implementation; the European Commission published the meeting account.
- Applicable sector
- AI providers and deployers, including financial services where relevant AI Act obligations apply; useful to legal, compliance, technology and security owners.
- Jurisdiction / authority
- European Union. A meeting report is an implementation signal, not a new law; non-EU institutions should assess territorial reach and their provider/deployer roles.
- Why selected
- Selected to show how enforcement coordination and transparency implementation are developing in practice. It helps leadership connect an applicable duty to a system owner and retained evidence.
Acronyms & key terms
- EU — European Union
- AI Board — European AI Board
- CIO — Chief Information Officer
- CISO — Chief Information Security Officer
Regulatory update · Published September 18, 2026 · Meeting September 17
The European Commission’s account of the ninth AI Board meeting covers enforcement priorities, market-surveillance cooperation, conformity-assessment governance, and support for transparency rules applicable since August 2. It also addresses frontier AI cybersecurity evaluation and testing infrastructure. The meeting report is an implementation signal; it does not itself create a new legal duty. Source: European Commission
Why it matters: Counsel and compliance need a defensible explanation of which obligations apply to each use case. CIOs and CISOs need the technical evidence behind that explanation, including how relevant transparency and security controls operate. A single date cannot substitute for an applicability assessment.
This week: Select one customer-facing AI workflow. Record its owner, provider/deployer roles, applicable transparency requirements and any relevant transition, implemented notices or markings, and the evidence retained. Bring unresolved classification questions to legal and compliance together.
Agentic-AI security: inventory the authority around the model
Context at a glance
- Organization / source
- Seyedakbar Mostafavi’s Trustworthy Agentic AI survey is a research preprint available through arXiv, a research repository; repository publication does not itself establish peer review.
- Applicable sector
- Organizations designing or procuring agents with memory, tools and delegation, including financial institutions performing architecture or supplier-assurance reviews.
- Jurisdiction / authority
- Global technical relevance. This is research synthesis, not a jurisdiction-specific legal requirement or a validated assurance standard.
- Why selected
- Selected because assurance must examine the operational system around the model. The survey offers architecture-review ideas for linking component inventories to permissions, observable behavior and control tests.
Acronyms & key terms
- AIBOM — AI bill of materials
- SBOM — Software bill of materials
- RAG — Retrieval-augmented generation
- SIEM — Security information and event management
- arXiv — Research preprint repository
Research preprint · September 12, 2026 · Architecture / assurance
Seyedakbar Mostafavi’s Trustworthy Agentic AI survey describes a synthesis of 206 studies and standards. It examines persistent memory, tool execution, and multi-agent collaboration, alongside defenses including capability-based access, isolation, sandboxing, and runtime instrumentation. This is a research synthesis, not a validated assurance standard; arXiv publication alone does not establish peer review. Source: arXiv
Why it matters: An AI bill of materials helps identify components, but it does not by itself establish what a running agent may access, change, retain, or delegate. The architecture review must connect component identity to operational authority and observable behavior.
This week: Extend one material AI inventory entry with its tool permissions, service identities, memory stores, external destinations, agent dependencies, and shutdown owner. Link each material capability to a test and a SIEM-observable event. Require counsel and compliance to identify the records needed for investigation and examination.
From hidden AI to continuous, defensible assurance.
Seven phases connect the AI inventory to enforceable authority, continuous assurance and responsible scale. Select a phase or use Previous and Next. Each phase pairs operating controls with the oversight question leadership should ask and the evidence it should require.
Fiduciary oversight: legal context and source notes
Applied governance guidance, not a finding of breach. These phase translations apply general oversight principles to AI; the cited decisions do not mandate this particular AI architecture. Under Delaware law, a Caremark oversight claim requires bad faith, such as an utter failure to establish a reporting system or a conscious failure to monitor it. An incident, imperfect control or poor result does not by itself establish a fiduciary breach. Stone v. Ritter, 911 A.2d 362, 369-73 (Del. 2006); Marchand v. Barnhill, 212 A.3d 805, 821-24 (Del. 2019).
Different roles, different responsibilities. Directors oversee; officers implement, monitor and report within their responsibilities. The Delaware Court of Chancery has recognized officer oversight duties in that context. Scope, knowledge, good faith, causation, governing law and available defenses matter. In re McDonald's Corp. Stockholder Derivative Litigation, 289 A.3d 343 (Del. Ch. 2023).
Disclosure is not a substitute for operation. For covered SEC registrants, Item 106 addresses disclosure of material cybersecurity risk processes, board oversight and management's role; it is not a universal AI control mandate. 17 CFR 229.106(b)-(c). The examples are governance recommendations; applicability and legal advice require the organization's facts and counsel. Primary case texts and Item 106 checked October 13, 2026 for these propositions. This is not an exhaustive citator, subsequent-history or jurisdiction-specific legal opinion.
A conversation about the work that matters.
For executive and board opportunities, AI governance, security leadership or a substantive exchange about the models on this site, contact me directly.
Professional conversations
Bring the business problem, the decision that needs to be made, or the control that needs to be proven.
redavis@davisinfogov.com
Email Rich opens your email application. This website does not submit a contact form or create an account. Do not send confidential, privileged or regulated information without an agreed secure channel.
Your information, your choice
No account is needed to explore the labs. Forum drafts are saved only in your browser when you explicitly save them; they are not published or sent to me.
For personal information you send to me, you may request access, correction or deletion through the privacy contact. Applicable retention exceptions are explained in the policy.
Privacy and data controlsThis opens your email application with a draft addressed to redavis@davisinfogov.com. Review your message and press Send. If no email application opens, use the address in your webmail.
Please do not send passwords, regulated data or confidential matter details before an appropriate engagement and secure communication channel are established. An inquiry alone does not create an attorney-client or consulting relationship.
Privacy Policy
What I collect and use
I receive the information you choose to send by email or another direct contact channel. I use it to respond, manage correspondence, protect the site and maintain records where needed. This release has no account registration, subscription database, server-side enquiry form or public posting service. I do not sell personal information through this site or include advertising, analytics or social-network tracking scripts in the site package.
Search, labs and private drafts
Search runs in your browser against public site content; I do not receive or store your search queries. Lab simulations do not send scenario inputs to a server or operate live enterprise controls. A temporary session identifier and return-location record may be kept in memory or session storage so you can return to the same place.
Forum drafts are saved only when you choose Save draft, in this browser's local storage. They are not submitted to me, indexed by site search or publicly posted. Local storage is not encrypted private storage: people or software with access to your browser profile may be able to read it. Do not put confidential client, employer, health or credential information in a draft. Delete a draft in the forum or clear all drafts using the main site's privacy control or your browser's site-data settings.
Your access, correction and deletion choices
You may ask whether I hold personal information about you, request a copy, ask me to correct inaccurate information or request deletion. I apply the privacy rights that govern the particular information and request, without treating residence-independent site choices as a statement that every privacy law applies. Where applicable, rights may also include portability, objection, restriction and withdrawal of consent. I will not discriminate against you for exercising applicable rights.
Email redavis@davisinfogov.com with the subject Privacy request. State the requested action without including unnecessary sensitive information. Proportionate identity verification may be necessary before disclosure or deletion. I cannot remotely access a local draft that was never sent to me.
Retention and legal limits
I retain direct correspondence only for its legitimate purpose and any applicable recordkeeping, legal-hold, dispute, fraud-prevention or security requirement. A request may be limited by a lawful retention obligation; I will explain an applicable exception rather than promise deletion I cannot lawfully perform. Local drafts remain until you delete them or the browser clears its storage. Hosting access/security-log retention depends on the actual hosting account and provider configuration; this package review does not establish a verified production retention period.
Hosting, fonts, sharing and external links
The host may record ordinary request information, including IP address, requested URL, time and browser details. The specified typefaces are referenced from this same site, not a third-party font service. Selecting an email link opens your mail application. Sharing controls prepare public links and may use your device's sharing service; social/source websites receive information when you choose to open them and have their own practices. Sharing controls do not intentionally include private drafts or lab-return session identifiers.
Hosting and email providers may process correspondence or operational data. Any legally required transfer safeguards depend on the providers, processing locations and applicable law. This site does not claim a particular cross-border transfer mechanism or provider audit that has not been verified.
Security and changes
The site is designed as a static, locally interactive publication with restricted script and resource loading. Security settings must also operate on the actual host. No site is immune from compromise. I will post material changes to these practices with a revised date and provide any additional notice required by law.
Privacy notice reviewed: October 13, 2026.
Govern the system around the model.
The model is only one component. The harness determines what AI can see, remember, call, change, delegate and prove. These three complementary workflows make that authority visible and testable.
Each scenario opens in its own window or tab. Clear phase controls, persistent explanations and a Close lab & return button keep the experience focused.
Build evidence once. Keep the legal duties distinct.
Each industry scenario follows a complete path: identify obligations, assign governance, enforce controls, capture evidence, reuse an assurance package and feed findings back into oversight. The underlying evidence can travel; applicability, scope and legal analysis must travel with it.
Open the lab, follow six guided steps, and select any box for a plain-language definition, a governance question and an evidence test. Close the lab to return here without losing your place.
This is a compact source overview. Open the full regulatory library for sector filters, applicability, duties and current status.
The evidence has to travel across AI, cyber, privacy, sector, and resilience requirements.
This is not a statement that every rule applies to every organization. Applicability depends on role, jurisdiction, industry, data, system classification, and use case. The point of Portable Trust is to design governance and evidence so that the same underlying control can be mapped accurately to each applicable obligation.
Regulatory summaries are orientation aids, not legal advice. Official-source links are provided for primary text or agency guidance.
Keep agentic capability subordinate to enterprise authority.
I use the Resilience Imperative as an operating principle for autonomous and agentic AI: resilience belongs to the enterprise, not the agent. The organization must be able to stop, reconstruct, and recover from an AI-enabled process even when the system is strongly optimized to continue the task.
A systems-risk and governance principle
It does not claim sentience or biological self-preservation. It addresses observable behavior: task optimization can make continuity, alternate routes, extra resources, broader access, persistence, or delegation useful means to an end.
Blocked execution can become a search problem
Denied permissions, failed tests, resource limits, shutdown instructions, network boundaries, or human intervention can be treated by an optimizer as obstacles. The control objective is to ensure the system cannot convert those obstacles into unauthorized means.
Apply it where autonomy has durable effect
Highest relevance: agents with persistent memory, tool execution, code access, privileged credentials, external messaging, transactions, infrastructure control, multi-agent delegation, long-lived artifacts, or the ability to alter their own operating environment.
Turn principle into auditable control
Board-approved authority boundaries, materiality tiers, independent control planes, least-privilege machine identities, synchronous action authorization, persistence governance, AI-DDR, immutable observability, incident response, recovery testing, and evidence retention convert the principle into demonstrable governance.
How it changes the assurance question
Instead of asking only whether the model can generate an unsafe output, ask whether the full AI-enabled process can plan, remember, and act its way around the control environment. The defensible governance position is that the enterprise foresaw the failure mode, assigned accountable ownership, constrained the authority, monitored for deviation, tested containment and recovery, and can produce the evidence.
Governance Forum: questions worth working through.
Questions I use to examine AI governance, executive oversight and assurance. Read the discussion prompts or prepare a private draft. This release is a discussion preview: there is no live community feed, account registration or public posting.
See how I turn risk into an operating model.
These guided scenarios connect technical architecture to authority, evidence and executive accountability. Start with the AI Harness, follow an incident through SIEM / AI-DDR, or explore how the same assurance discipline applies in six industries.
Choose a scenario below. In the lab window, select Start guided walkthrough, advance with Next step, and select any box for its explanation. Use Close lab & return to come back to this exact place. Nothing runs against a live system.
Illustrative design studies, not live security tooling, certification or legal advice. The industry labs reuse evidence concepts without treating distinct legal duties as interchangeable.
Financial-services glossary
I connect regulatory language to its source, business activity and practical governance implications. This public edition includes terms associated with the Financial services & insurance research set.
How to navigate / scope and jurisdiction cautions
Choose a financial activity, then refine by issuing region, jurisdiction and instrument. The remaining filter choices are drawn only from the selected financial research set. No result means no mapped public match, not an exemption.
NAICS is an activity-navigation aid, not a legal-applicability test. A banking charter, MSB registration and insurance license differ. Headquarters alone does not determine applicable law; assess entity, activities, customers, data, product, territorial nexus and local implementation. Shared frameworks remain available when relevant. HIPAA appears where the inherited insurance/PBM activity mapping calls for it.
Public records retain their own review dates and limitations. This access revision is not a new legal-source audit. Read the official source before relying on a summary. The preview can be read and copied; it is not a subscriber database.
More below: choose filters, then scroll to the matching references.
178 public financial-services records. JavaScript adds filtering; the readable public subset follows.
50 Percent Rule (OFAC)
OFAC ownership rule
The rule treating an entity as blocked when one or more blocked persons own, directly or indirectly, 50 percent or more in the aggregate, even if the entity is not separately listed.
Context, practical use & authoritative sources
Practical significance
Name screening alone is insufficient. Establish ownership relationships and distinguish ownership from control-only risk.
Definition context
US sanctions; aggregation, indirect ownership and specific program provisions require review.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
US economic sanctions / OFAC compliance
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Accountability
Assignment of responsibility for decisions and outcomes, together with mechanisms for explanation, review and corrective action.
Context, practical use & authoritative sources
Practical significance
An agent cannot replace the accountable business, model or risk owner.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Delaware fiduciary oversight jurisprudence
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
California AB1405 - AI auditor registry and independence
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
New York Responsible AI Safety and Education (RAISE) Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Bank Secrecy Act / AML program requirements
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
NAIC model bulletin on insurer use of AI
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
General Data Protection Regulation
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
PIPEDA
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
APRA CPS 234 - Information Security
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Singapore Personal Data Protection Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Singapore PDPC guidance on AI use of personal data
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Brazil General Personal Data Protection Law
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
OECD AI Principles
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
NIST SP 800-218A: AI-model secure development profile
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
CISA / international partners: SBOM for AI minimum elements
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
CISA: 2026 minimum elements for an SBOM
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Action interlocks
Tool, MCP & Action Control
Place enforceable checks between a proposed operation and its side effects. Tool availability, a model request and transport-level access must not be mistaken for business authorization.
Context, practical use & authoritative sources
Practical significance
Approve a low-value test action, then change its amount or destination before dispatch. The changed request must require a new decision. Also test an unapproved MCP server and a retrieved instruction requesting a privileged tool.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
MCP authorization specification (2026-07-28)
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Adversarial machine learning
AML
Study and practice of attacks against machine-learning systems and defenses against them, including manipulation during training or inference and privacy attacks.
Context, practical use & authoritative sources
Practical significance
Scope testing to attacker access, objectives and model/system lifecycle stages.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
MITRE ATLAS
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Adverse action (Regulation B)
ECOA adverse action
A covered unfavorable credit decision or change within Regulation B's definition, subject to specific exclusions.
Context, practical use & authoritative sources
Practical significance
Assess the actual decision and required notice; a model score is not itself the full legal event.
Definition context
United States; Equal Credit Opportunity Act and Regulation B.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
Equal Credit Opportunity Act / Regulation B
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Agentic AI
AI agent
An operational system in which a model participates in selecting actions or plans, using tools and feedback to pursue an objective over one or more steps. Agency comes from the system's execution design, not text generation alone.
Context, practical use & authoritative sources
Practical significance
Set authority limits, step budgets, independent action checks and tested interruption paths.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Interagency model risk management guidance - SR26-2
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
NCCoE: software and AI-agent identity and authorization
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
AI bill of materials
AIBOM
A structured inventory of AI-related components such as models, datasets, software, tools and dependencies. Schemas and completeness expectations vary.
Context, practical use & authoritative sources
Practical significance
Define scope and provenance explicitly; a list without validation does not establish trustworthiness.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
CISA / international partners: SBOM for AI minimum elements
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
NIST SP 800-218A: AI-model secure development profile
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
CISA: 2026 minimum elements for an SBOM
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
AI governance
The structures, roles, policies and decisions that direct and control AI use across its lifecycle, with accountable management of risks, outcomes and obligations.
Context, practical use & authoritative sources
Practical significance
Assign authority and evidence requirements before scaling deployment.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Texas Responsible Artificial Intelligence Governance Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
NAIC model bulletin on insurer use of AI
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
ISO/IEC 42001 AI management systems
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
OECD AI Principles
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
California September 2026 AI oversight executive direction
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
AI literacy
AI competence
Skills, knowledge and understanding enabling providers, deployers and affected people to make informed decisions about AI and its opportunities, risks and possible harm.
Context, practical use & authoritative sources
Practical significance
Tailor training to the person's role, system and context; attendance alone is not evidence of competence.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
AI regulatory sandbox
regulatory sandbox
A supervised regulatory arrangement that enables development, testing and validation of AI systems under an agreed plan and conditions.
Context, practical use & authoritative sources
Practical significance
Do not confuse regulatory participation with a technical execution sandbox or an exemption from all applicable law.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
AI risk management
The coordinated process of identifying, analyzing, evaluating, treating and monitoring AI-related risks to organizations and affected people.
Context, practical use & authoritative sources
Practical significance
Tie assessment to purpose, context, affected populations and actual authority.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST AI Risk Management Framework 1.0
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
ISO/IEC 23894 AI risk management
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
NIST AI RMF critical-infrastructure profile - concept stage
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Artificial intelligence
AI
A family of machine-based systems that infer from inputs how to produce predictions, content, recommendations or decisions for explicit or implicit objectives. Systems differ in autonomy, adaptiveness and impact; not every automated rule is legally classified as AI.
Context, practical use & authoritative sources
Practical significance
Inventory the deployed system and its decisions, not only a product label.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Texas Responsible Artificial Intelligence Governance Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
California Transparency in Frontier Artificial Intelligence Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
European Union Artificial Intelligence Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Attack surface
The reachable interfaces, components and trust relationships through which an adversary can interact with a system.
Context, practical use & authoritative sources
Practical significance
Include prompts, retrieval sources, tools, credentials and suppliers in AI attack-surface reviews.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
OWASP AI security guidance
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Audience-bound token
A token intended for a specified receiving service or resource, rather than unrestricted use across tools and systems.
Context, practical use & authoritative sources
Practical significance
Validate issuer and audience and reject a token meant for another resource.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
MCP authorization specification (2026-07-28)
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Audit
A systematic examination of evidence against defined criteria by a suitably competent party, with independence appropriate to the engagement.
Context, practical use & authoritative sources
Practical significance
Avoid presenting self-assessment as an independent audit.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
FTC Act, Section 5
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
New York City Local Law 144 - automated employment decisions
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Interagency third-party relationship risk management
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Bank Secrecy Act / AML program requirements
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
ISO/IEC 42001 AI management systems
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
ISO/IEC 27001 information security management
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
California SB813 - independent AI verification organizations
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
California AB1405 - AI auditor registry and independence
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Authorised representative (EU AI Act)
authorized representative
An EU-established person with a written mandate from the provider to perform specified regulatory tasks on its behalf.
Context, practical use & authoritative sources
Practical significance
Check the mandate and appointment duties; this is not the same as a reseller or a general agent.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Authority lineage
Identity, Delegation & Authorization
Keep the initiating person, each delegated agent and the executing service attributable. A handoff should narrow or preserve authorized scope, not silently create new authority.
Context, practical use & authoritative sources
Practical significance
Give a child agent an out-of-scope target, an expired mandate and a token meant for a different audience. Verify denial at the enforcement point and verify that revoking the parent stops delegated and queued actions.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NCCoE: software and AI-agent identity and authorization
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Authorization
AuthZ
Determining and enforcing the permissions an identified subject has for a resource or action under defined conditions.
Context, practical use & authoritative sources
Practical significance
Evaluate each consequential action, not merely whether a session is logged in.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
MCP authorization specification (2026-07-28)
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
NCCoE: software and AI-agent identity and authorization
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
China Data Security Law
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
NIST SP800-53 Rev.5 - security and privacy controls
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
NIST incident response recommendations
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
OpenTelemetry GenAI span conventions
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Authorization boundary
system boundary
The scope of components and services included in a system authorization decision and its associated assessment.
Context, practical use & authoritative sources
Practical significance
Identify inherited services and interfaces so responsibility does not disappear at the boundary.
Definition context
NIST technical/control vocabulary; binding force depends on adoption, law or contract.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
NIST SP800-53 Rev.5 - security and privacy controls
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
NIST Cybersecurity Framework
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST Privacy Framework - final 1.0 / draft 1.1
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST SSDF - SP800-218 v1.1 / v1.2 draft
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST incident response recommendations
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Automated decision-making
ADM / ADMT
Use of computational outputs to make or materially influence decisions. Legal restrictions depend on the law, impact and degree of meaningful human involvement.
Context, practical use & authoritative sources
Practical significance
Identify consequential decisions and provide required notice, explanation, review and contestability.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
New York City Local Law 144 - automated employment decisions
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Colorado automated decisionmaking law - SB26-189
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
UK GDPR / Data Protection Act 2018 / DUAA 2025
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Quebec private-sector privacy law (Law 25 reforms)
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Singapore PDPC guidance on AI use of personal data
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Behavioral conformance
Runtime Behaviour & Inference Assurance
Evaluate the sequence of plans, tool requests, retries, delegations and outcomes against an approved operating envelope. A plausible final answer is not evidence that the route taken was authorized.
Context, practical use & authoritative sources
Practical significance
Introduce access denial, a failed tool and an impossible task. Confirm the system stops or escalates within scope rather than silently widening permissions, fabricating completion or continuing indefinitely.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
OWASP Top 10 for Agentic Applications 2026
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Beneficial owner (CDD Rule)
beneficial ownership
A natural person meeting the ownership or control prong for a covered legal entity customer under the CDD Rule.
Context, practical use & authoritative sources
Practical significance
Apply the specific definition, exemptions and current account-opening relief; do not import Corporate Transparency Act or sanctions definitions.
Definition context
US financial institutions; CDD rules and May 2026 updated FAQ. Entity-specific exceptions and relief apply.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
Bank Secrecy Act / AML program requirements
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Biometric data
Data from technical processing of physical, physiological or behavioral characteristics that can identify or confirm identity, with legal scope varying by jurisdiction.
Context, practical use & authoritative sources
Practical significance
Assess purpose, consent/authorization, retention and risks of immutable identifiers.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Illinois Biometric Information Privacy Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Texas Responsible Artificial Intelligence Governance Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Biometric identification
one-to-many matching
Automated identification of a person by comparing their biometric characteristics with biometric data held about multiple people.
Context, practical use & authoritative sources
Practical significance
Distinguish one-to-many identification from one-to-one identity verification; the legal treatment can differ.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Biometric verification
one-to-one matching
Automated one-to-one checking of a person's claimed identity against previously provided biometric data.
Context, practical use & authoritative sources
Practical significance
Document the verification purpose and avoid silently repurposing it into identification or categorization.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Blocked property
frozen assets
Property or an interest in property subject to a sanctions freeze prohibiting dealings without authorization; ownership is not simply transferred to the government.
Context, practical use & authoritative sources
Practical significance
Distinguish blocking from rejecting a transaction, and route potential matches for authorized review.
Definition context
US sanctions; terms must be read with the relevant sanctions program and applicable licenses.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
US economic sanctions / OFAC compliance
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Business associate (HIPAA)
BA
A non-workforce actor performing specified functions or services for a covered entity involving protected health information, including qualifying downstream subcontractors.
Context, practical use & authoritative sources
Practical significance
Analyze the actual service and information flow, not just whether a vendor signed a template contract.
Definition context
US HIPAA; 45 CFR 160.103. eCFR is an authoritative but unofficial compilation.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
HIPAA Privacy and Breach Notification Rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
HIPAA Security Rule
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Business continuity
BC
The capability and planning needed to sustain prioritized operations during disruption at acceptable levels.
Context, practical use & authoritative sources
Practical significance
Link dependencies, manual alternatives and decision authority to critical AI-enabled processes.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
APRA CPS 230 - Operational Risk Management
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Compensating control
compensating safeguard
An alternative safeguard selected and justified to address a requirement or risk when the standard control cannot be used as specified, where the governing framework permits it.
Context, practical use & authoritative sources
Practical significance
Document equivalence, limitations, approvals and test evidence; it is not a universal waiver.
Definition context
NIST technical/control vocabulary; binding force depends on adoption, law or contract.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
NIST SP800-53 Rev.5 - security and privacy controls
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
NIST Cybersecurity Framework
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST Privacy Framework - final 1.0 / draft 1.1
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST SSDF - SP800-218 v1.1 / v1.2 draft
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST incident response recommendations
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Confidentiality, integrity and availability
CIA
Confidentiality restricts unauthorized disclosure; integrity protects against improper modification or destruction; availability supports timely, reliable access. These objectives can require different controls.
Context, practical use & authoritative sources
Practical significance
Evaluate each objective against the business process, including AI-mediated actions.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
ePrivacy Directive and national implementing laws
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Conformity assessment
conformity evaluation
The process used to demonstrate whether applicable legal requirements for a product or system have been met.
Context, practical use & authoritative sources
Practical significance
Record the applicable assessment route, scope and evidence; do not equate a general audit with statutory conformity.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Confused deputy
A privileged component is induced to misuse its authority on behalf of a less-privileged requester. An agent may act with service-account permissions wider than the user's own.
Context, practical use & authoritative sources
Practical significance
Bind actions to the initiating user's entitlements as well as the workload's identity.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
OWASP Top 10 for Agentic Applications 2026
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Consent
A permission mechanism whose required characteristics depend on the applicable law; GDPR requires a freely given, specific, informed and unambiguous indication in relevant circumstances.
Context, practical use & authoritative sources
Practical significance
Avoid bundled or coerced choices and make withdrawal effective where consent is relied on.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
California Consumer Privacy Act / CPRA
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Colorado Privacy Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Illinois Biometric Information Privacy Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
General Data Protection Regulation
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
ePrivacy Directive and national implementing laws
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Privacy and Electronic Communications Regulations
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
PIPEDA
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Australian Privacy Act and Australian Privacy Principles
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Singapore Personal Data Protection Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
India Digital Personal Data Protection Act and Rules
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
South Africa Protection of Personal Information Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Virginia Consumer Data Protection Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Connecticut Data Privacy Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Singapore PDPC guidance on AI use of personal data
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
China Personal Information Protection Law
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
China Interim Measures for Generative AI Services
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Consent Manager (India DPDP)
Consent Manager
A person registered with the Board to provide a single point for giving, managing, reviewing and withdrawing consent through an accessible, transparent and interoperable platform.
Context, practical use & authoritative sources
Practical significance
A cookie-consent tool is not automatically a registered Consent Manager; check registration and operative requirements.
Definition context
India DPDP Act 2023; Section 2. Definitions do not establish commencement of every substantive duty.
Section 2 of the official Gazette PDF was read. This is a definition review, not a current consolidated-law or commencement audit; phased duties require separate checking.
Related financial-services research instruments
India Digital Personal Data Protection Act and Rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Containment
Actions limiting the spread, access, effects or further harm of an incident while enabling investigation and recovery.
Context, practical use & authoritative sources
Practical significance
Pre-authorize appropriate actions and verify that credentials, tools and child processes are actually constrained.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST incident response recommendations
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
MITRE ATLAS
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Content provenance
content credentials
Information about the origin and history of digital content, potentially protected by cryptographic assertions. Provenance alone does not establish the factual truth of the depicted content.
Context, practical use & authoritative sources
Practical significance
Verify signatures and trust chains while evaluating the content independently.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
California AI Transparency Act - SB942, AB853 and 2026 amendments
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
NIST Generative AI Profile
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Continuous monitoring
ISCM
Ongoing awareness of security, privacy or risk posture through the collection and assessment of defined information.
Context, practical use & authoritative sources
Practical significance
Define cadence, coverage and corrective action; continuous does not mean every event is observed or instantly prevented.
Definition context
NIST technical/control vocabulary; binding force depends on adoption, law or contract.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
NIST SP800-53 Rev.5 - security and privacy controls
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
NIST Cybersecurity Framework
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST Privacy Framework - final 1.0 / draft 1.1
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST SSDF - SP800-218 v1.1 / v1.2 draft
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST incident response recommendations
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Control assessment
security control assessment
Evaluation of whether controls are implemented correctly, operating as intended and producing the desired outcomes against defined criteria.
Context, practical use & authoritative sources
Practical significance
Specify criteria, method, sample, period and limitations; a screenshot of a setting is not complete operating evidence.
Definition context
NIST technical/control vocabulary; binding force depends on adoption, law or contract.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
NIST SP800-53 Rev.5 - security and privacy controls
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
NIST Cybersecurity Framework
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST Privacy Framework - final 1.0 / draft 1.1
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST SSDF - SP800-218 v1.1 / v1.2 draft
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST incident response recommendations
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Control inheritance
inherited control
Reliance on controls supplied by another organizational function or service, with responsibilities and evidence identified.
Context, practical use & authoritative sources
Practical significance
Obtain the provider evidence and document what the customer still must implement.
Definition context
NIST technical/control vocabulary; binding force depends on adoption, law or contract.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
NIST SP800-53 Rev.5 - security and privacy controls
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
NIST Cybersecurity Framework
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST Privacy Framework - final 1.0 / draft 1.1
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST SSDF - SP800-218 v1.1 / v1.2 draft
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST incident response recommendations
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Control objective
The intended risk-reduction or compliance outcome a control is meant to achieve, separate from a particular product or procedure.
Context, practical use & authoritative sources
Practical significance
State the objective so independent testing can determine whether it was achieved.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST SP800-53 Rev.5 - security and privacy controls
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Covered entity (HIPAA)
HIPAA covered entity
A health plan, health care clearinghouse, or health care provider that electronically transmits health information in a transaction covered by HIPAA.
Context, practical use & authoritative sources
Practical significance
Do not assume every health app, employer or health-data recipient is a HIPAA covered entity.
Definition context
US HIPAA; 45 CFR 160.103. eCFR is an authoritative but unofficial compilation.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
HIPAA Privacy and Breach Notification Rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
HIPAA Security Rule
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Covered entity (NYDFS Part 500)
NYDFS covered entity
A person operating, or required to operate, under specified authorization in New York's Banking, Insurance or Financial Services Law.
Context, practical use & authoritative sources
Practical significance
Establish the legal entity and authorization; an industry code or New York customer alone does not decide coverage.
Definition context
New York Part 500 definitions; DFS labels this reading copy unofficial. Consult the operative compilation for legal reliance. These are not HIPAA or GLBA definitions.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
NYDFS Cybersecurity Regulation
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Credit scoring system (Regulation B)
credit scoring
A system that evaluates creditworthiness mechanically using assigned numerical scores, including a distinct category for empirically derived, demonstrably and statistically sound systems.
Context, practical use & authoritative sources
Practical significance
Do not label every AI decision system a qualifying scoring system without examining the regulatory criteria.
Definition context
United States; Equal Credit Opportunity Act and Regulation B.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
Equal Credit Opportunity Act / Regulation B
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Critical or important function (DORA)
CIF
A function whose disruption or deficient performance would materially affect specified financial performance, service continuity or compliance with financial-services obligations.
Context, practical use & authoritative sources
Practical significance
Classify the function case by case; the supplier's marketing tier does not make the determination.
Definition context
EU DORA; Commission answer explaining Article 3(22).
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
Digital Operational Resilience Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Cross-context behavioral advertising
CCBA
Targeting advertising using personal information obtained from a consumer's activity across businesses or distinctly branded services under the CCPA definition.
Context, practical use & authoritative sources
Practical significance
Review advertising pixels and recipients; a website's lack of an explicit ad banner does not resolve its data flows.
Definition context
California CCPA/CPRA; official guidance, with statutory definitions and exceptions controlling.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
California Consumer Privacy Act / CPRA
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
California Delete Act / DROP data-broker deletion system
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Cryptographic agility
crypto-agility
The ability to replace or adjust cryptographic algorithms, parameters and implementations without unacceptable operational disruption.
Context, practical use & authoritative sources
Practical significance
Maintain inventories, abstraction, migration testing and rollback plans.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST post-quantum cryptography standards
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Customer due diligence
CDD
Procedures for understanding customers and the nature and purpose of relationships, verifying relevant identities and maintaining risk-based monitoring and information.
Context, practical use & authoritative sources
Practical significance
Distinguish applicable CDD rules from generic KYC terminology; do not apply bank requirements automatically to every nonbank business.
Definition context
US financial institutions; CDD rules and May 2026 updated FAQ. Entity-specific exceptions and relief apply.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
Bank Secrecy Act / AML program requirements
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Customer information (FTC Safeguards Rule)
GLBA customer information
A record containing nonpublic personal information about a financial institution's customer that is handled or maintained by, or on behalf of, the regulated institution.
Context, practical use & authoritative sources
Practical significance
Identify service-provider copies and records in every medium covered by the rule.
Definition context
US FTC Safeguards Rule; entity and information scope are rule-specific.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
GLBA and FTC Safeguards Rule
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Customer risk profile
customer risk assessment
The risk-based understanding of a customer's nature and purpose used to support ongoing monitoring and due diligence.
Context, practical use & authoritative sources
Practical significance
Record input provenance and review AI risk scores for data quality and inappropriate proxies.
Definition context
US financial institutions; CDD rules and May 2026 updated FAQ. Entity-specific exceptions and relief apply.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
Bank Secrecy Act / AML program requirements
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Cybersecurity event (NYDFS)
Part 500 event
An actual or attempted unauthorized access, disruption or misuse of an information system or its information, whether successful or not.
Context, practical use & authoritative sources
Practical significance
Distinguish the broad event population from the narrower reportable-incident tests.
Definition context
New York Part 500 definitions; DFS labels this reading copy unofficial. Consult the operative compilation for legal reliance. These are not HIPAA or GLBA definitions.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
NYDFS Cybersecurity Regulation
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Cybersecurity incident (NYDFS)
Part 500 incident
A cybersecurity event satisfying Part 500's specified impact, notification, material-harm or ransomware conditions for the covered entity, affiliates or third-party providers.
Context, practical use & authoritative sources
Practical significance
Apply the incident definition and notice rules separately; not every blocked attack is reportable.
Definition context
New York Part 500 definitions; DFS labels this reading copy unofficial. Consult the operative compilation for legal reliance. These are not HIPAA or GLBA definitions.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
NYDFS Cybersecurity Regulation
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Data controller
The entity determining the purposes and means of personal-data processing under GDPR and related frameworks. The contractual label alone does not determine the role.
Context, practical use & authoritative sources
Practical significance
Document actual decisions and shared responsibilities across AI providers and deployers.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Virginia Consumer Data Protection Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Colorado Privacy Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Texas Data Privacy and Security Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
General Data Protection Regulation
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
UK GDPR / Data Protection Act 2018 / DUAA 2025
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Brazil General Personal Data Protection Law
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Data Fiduciary (India DPDP)
Data Fiduciary
A person determining, alone or with others, the purpose and means of processing personal data under India's DPDP Act.
Context, practical use & authoritative sources
Practical significance
Do not equate this statutory role with a corporate director's fiduciary duty or import GDPR obligations wholesale.
Definition context
India DPDP Act 2023; Section 2. Definitions do not establish commencement of every substantive duty.
Section 2 of the official Gazette PDF was read. This is a definition review, not a current consolidated-law or commencement audit; phased duties require separate checking.
Related financial-services research instruments
India Digital Personal Data Protection Act and Rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Data lineage
provenance
Lineage records how data moves or is transformed; provenance concerns origin and history. Both help connect outputs to sources, permissions and changes.
Context, practical use & authoritative sources
Practical significance
Carry provenance through chunks, model versions, prompts, tools and resulting evidence.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
California AI Transparency Act - SB942, AB853 and 2026 amendments
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Equal Credit Opportunity Act / Regulation B
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
China Interim Measures for Generative AI Services
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
New Zealand Privacy Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
NIST Generative AI Profile
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
NIST SSDF - SP800-218 v1.1 / v1.2 draft
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
NIST SP 800-218A: AI-model secure development profile
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
CISA / international partners: SBOM for AI minimum elements
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
CISA: 2026 minimum elements for an SBOM
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Data minimization
Limiting personal-data collection and use to what is adequate, relevant and necessary for the stated purpose.
Context, practical use & authoritative sources
Practical significance
Apply to telemetry, prompts, embeddings, evidence exports and test data.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
HIPAA Privacy and Breach Notification Rules
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Singapore PDPC guidance on AI use of personal data
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
NIST Privacy Framework - final 1.0 / draft 1.1
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Data portability
A right under defined conditions to receive certain personal data in a structured, commonly used, machine-readable form or transmit it to another controller.
Context, practical use & authoritative sources
Practical significance
Distinguish statutory portability from a general requirement to export every internal model artifact.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
California Consumer Privacy Act / CPRA
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Data Principal (India DPDP)
Data Principal
The individual to whom personal data relates; the definition includes specified parental or guardian representation.
Context, practical use & authoritative sources
Practical significance
Identify the relevant person and representation rules without treating the term as a separate class of corporate customer.
Definition context
India DPDP Act 2023; Section 2. Definitions do not establish commencement of every substantive duty.
Section 2 of the official Gazette PDF was read. This is a definition review, not a current consolidated-law or commencement audit; phased duties require separate checking.
Related financial-services research instruments
India Digital Personal Data Protection Act and Rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Data processor
An entity processing personal data on a controller's behalf, within applicable legal and contractual constraints.
Context, practical use & authoritative sources
Practical significance
Control instructions, subprocessors, security and assistance with individual rights.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Virginia Consumer Data Protection Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
General Data Protection Regulation
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
UK GDPR / Data Protection Act 2018 / DUAA 2025
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Data Processor (India DPDP)
DPDP processor
A person processing personal data on behalf of a Data Fiduciary under the DPDP Act.
Context, practical use & authoritative sources
Practical significance
Keep processor instructions, contracts and actual processing roles distinct from the GDPR's independently applicable requirements.
Definition context
India DPDP Act 2023; Section 2. Definitions do not establish commencement of every substantive duty.
Section 2 of the official Gazette PDF was read. This is a definition review, not a current consolidated-law or commencement audit; phased duties require separate checking.
Related financial-services research instruments
India Digital Personal Data Protection Act and Rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Data protection impact assessment
DPIA
A structured assessment of personal-data processing likely to create high risks to individuals, including necessity, proportionality, risks and safeguards under GDPR.
Context, practical use & authoritative sources
Practical significance
Complete before deployment where required and revisit material changes.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Colorado Privacy Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
General Data Protection Regulation
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Swiss Federal Act on Data Protection
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Data residency
The geographic location where data is stored or processed. Residency differs from legal transfer rules, access by foreign entities and confidentiality guarantees.
Context, practical use & authoritative sources
Practical significance
Map remote access, support, telemetry and backups as well as the primary hosting region.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
China Data Security Law
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Data subject
The person to whom personal data relates, particularly in GDPR terminology.
Context, practical use & authoritative sources
Practical significance
Design rights handling across source data, logs, vectors and downstream processors.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Brazil General Personal Data Protection Law
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Connecticut Data Privacy Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Data subject access request
DSAR / right of access
A request to exercise access rights to personal information and related processing details, within the applicable regime's scope and limits.
Context, practical use & authoritative sources
Practical significance
Locate relevant records across AI workflows while protecting others' rights and confidential material.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
California Delete Act / DROP data-broker deletion system
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Data use agreement (HIPAA)
DUA
The agreement governing a limited data set's permitted uses, recipients and safeguards, including restrictions on identification and contact.
Context, practical use & authoritative sources
Practical significance
Specify the allowed purpose and downstream terms before using a limited data set in analytics or AI.
Definition context
US HIPAA; 45 CFR 164.514. Legal exceptions and permitted purposes matter.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
HIPAA Privacy and Breach Notification Rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Decision evidence
Execution Provenance & Forensics
Create an independently protected record connecting the mandate, relevant inputs, versions, policy decisions, actions and observed outcomes. Make uncertainty and missing evidence explicit.
Context, practical use & authoritative sources
Practical significance
Attempt to modify evidence from the agent role, drop a collector feed and produce a false success message. Verify denial, a visible evidence-gap alert and an outcome report that distinguishes assertion from corroborated state.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
OpenTelemetry GenAI span conventions
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Delegated authority chain
Delegation chain
A record linking the initiating principal, delegated agents and executing services to the mandate and permissions for a task.
Context, practical use & authoritative sources
Practical significance
Track onward delegation and the scope retained at each handoff.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NCCoE: software and AI-agent identity and authorization
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Delegation
Assigning a subtask or authority to another agent, person or service. Delegation should not enlarge privileges or remove the originating owner's accountability.
Context, practical use & authoritative sources
Practical significance
Bind scope, duration and permitted onward delegation to each handoff.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NCCoE: software and AI-agent identity and authorization
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Deployer (EU AI Act)
AI deployer
An actor using an AI system under its authority, other than for a personal, non-professional activity.
Context, practical use & authoritative sources
Practical significance
Separate the deploying organization's duties from those of the developer and an individual end user.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Digital operational resilience
DORA resilience
A financial entity's ability to maintain operational integrity and reliability through the capabilities needed to manage ICT-related disruption and support financial services.
Context, practical use & authoritative sources
Practical significance
Assess business-service continuity and third-party dependencies, not uptime alone.
Definition context
EU DORA; overview and linked technical standards. Definitions below are explanatory summaries.
Official EIOPA overview and linked-standard index reviewed; direct EUR-Lex retrieval was restricted. Explanatory orientation, not clause-level validation.
Related financial-services research instruments
Digital Operational Resilience Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Disclosure controls and procedures
disclosure controls
Processes designed to ensure required issuer disclosures are recorded, processed, summarized and reported, with information communicated for timely decisions.
Context, practical use & authoritative sources
Practical significance
Connect technical incident escalation to the disclosure decision makers and preserve the basis for their assessment.
Definition context
United States public-company reporting; materiality and filing duties are context-specific.
SEC official adoption summary supports orientation; use the operative rules and filing instructions for an actual issuer decision.
Related financial-services research instruments
SEC cybersecurity disclosure rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
SEC Regulation S-P
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Distributed trace
trace ID / span
A correlated record of a request across components; spans represent individual operations within the trace.
Context, practical use & authoritative sources
Practical significance
Preserve correlation across model, retrieval, policy and tool calls with privacy-appropriate logging.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
OpenTelemetry GenAI span conventions
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Distributor (EU AI Act)
AI distributor
A supply-chain actor, other than provider or importer, that makes an AI system available on the Union market.
Context, practical use & authoritative sources
Practical significance
Distinguish distribution from use and identify any verification or corrective-action duties.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Electronic protected health information
ePHI
Protected health information maintained or transmitted in the electronic media covered by the HIPAA definition.
Context, practical use & authoritative sources
Practical significance
Include electronic copies, system integrations and covered processing environments in the Security Rule scope.
Definition context
US HIPAA; 45 CFR 160.103. eCFR is an authoritative but unofficial compilation.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
HIPAA Privacy and Breach Notification Rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
HIPAA Security Rule
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Emotion recognition system
emotion inference
An AI system intended to identify or infer people's emotions or intentions from biometric data.
Context, practical use & authoritative sources
Practical significance
Establish the source data, use context and any prohibition or exception before deploying it.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Encryption
A transformation using cryptography to protect confidentiality, with keys controlling recovery of the original information.
Context, practical use & authoritative sources
Practical significance
Govern key access, algorithms, implementations and data handling before and after encryption.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
GLBA and FTC Safeguards Rule
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
PCI DSS v4.0.1
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Erasure
right to deletion
A right to deletion under specified conditions, with exceptions such as legal obligations or legal claims. It is not an unconditional right to erase every record.
Context, practical use & authoritative sources
Practical significance
Map records, backups, retrieval indexes and processor copies, and document any lawful retention.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
California Delete Act / DROP data-broker deletion system
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Excessive agency
Risk arising from unnecessary functionality, permissions or autonomy given to an AI-enabled system.
Context, practical use & authoritative sources
Practical significance
Minimize executable capabilities and require independent authorization for material effects.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
OWASP AI security guidance
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
OWASP Top 10 for Agentic Applications 2026
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Expert determination (HIPAA)
expert de-identification
A qualified expert's documented finding that the risk of identification is very small under the specified data, recipient and anticipated-use conditions.
Context, practical use & authoritative sources
Practical significance
Retain the analysis and evaluate changes to linkage data or recipients; the finding is not universal anonymity.
Definition context
US HIPAA; 45 CFR 164.514. Legal exceptions and permitted purposes matter.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
HIPAA Privacy and Breach Notification Rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Explainability
Providing information about the mechanisms or factors contributing to a system's output in a way useful to the relevant audience.
Context, practical use & authoritative sources
Practical significance
Match explanations to users' decisions; a fluent narrative may not reflect the true mechanism.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Equal Credit Opportunity Act / Regulation B
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Fairness
A context-dependent set of considerations concerning harmful bias and equitable treatment. Different statistical fairness criteria can conflict.
Context, practical use & authoritative sources
Practical significance
Choose and justify criteria with legal, domain and affected-stakeholder input.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Title VII and employment discrimination
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Americans with Disabilities Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Equal Credit Opportunity Act / Regulation B
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
NAIC model bulletin on insurer use of AI
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
FCA Consumer Duty
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
China Personal Information Protection Law
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Fiduciary oversight
The responsibilities of directors and relevant officers to exercise oversight under applicable corporate law. In Delaware, oversight claims involve demanding, context-specific standards; an adverse outcome alone is not a breach.
Context, practical use & authoritative sources
Practical significance
Maintain reasonable reporting systems and respond in good faith to significant warnings within assigned responsibilities.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
SEC cybersecurity disclosure rules
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Delaware fiduciary oversight jurisprudence
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Financial institution (FTC Safeguards Rule)
Safeguards financial institution
An institution within the rule's defined financial-activity and FTC-jurisdiction scope, not merely an organization using finance software.
Context, practical use & authoritative sources
Practical significance
Check the statutory activity test, examples and jurisdictional boundaries before treating a firm as covered.
Definition context
US FTC Safeguards Rule; entity and information scope are rule-specific.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
GLBA and FTC Safeguards Rule
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Foundation model
FM
A model trained on broad data at scale that can be adapted to many downstream tasks. A foundation model is an underlying capability, not a finished governed business process.
Context, practical use & authoritative sources
Practical significance
Assess shared-model concentration and the controls added by each downstream application.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
California Transparency in Frontier Artificial Intelligence Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
New York Responsible AI Safety and Education (RAISE) Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
General-purpose AI model
GPAI
An EU AI Act category for models with significant generality capable of competently performing a wide range of distinct tasks and integration into many systems. It is a legal category, not a synonym for AGI.
Context, practical use & authoritative sources
Practical significance
Determine provider, downstream and systemic-risk roles against the actual statutory definition.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
European Union Artificial Intelligence Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Generative AI
GenAI / GAI
AI that produces synthetic content such as text, code, images, audio or video based on learned patterns. It may generate plausible content that is inaccurate, harmful or unsupported.
Context, practical use & authoritative sources
Practical significance
Require validation, provenance and approval appropriate to the consequences of publication or execution.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
California AI Transparency Act - SB942, AB853 and 2026 amendments
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
China Interim Measures for Generative AI Services
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
NIST Generative AI Profile
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Interagency model risk management guidance - SR26-2
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
OpenTelemetry GenAI span conventions
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Governance, risk and compliance
GRC
Coordinated governance of objectives and authority, management of risk, and fulfillment of applicable obligations.
Context, practical use & authoritative sources
Practical significance
Connect the legal requirement to the actual control owner, test and decision record.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST Cybersecurity Framework
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Hallucination
confabulation
Generated content presented plausibly but unsupported or false in the relevant context. It can include invented facts, citations, conclusions or assertions about actions performed.
Context, practical use & authoritative sources
Practical significance
Require evidence checks where decisions affect rights, finances, safety or public statements.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST Generative AI Profile
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Health care clearinghouse
healthcare clearinghouse
An entity that converts or facilitates conversion between nonstandard health information and standard transaction formats or data elements.
Context, practical use & authoritative sources
Practical significance
Include claims-processing intermediaries in the entity and data-flow inventory.
Definition context
US HIPAA; 45 CFR 160.103. eCFR is an authoritative but unofficial compilation.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
HIPAA Privacy and Breach Notification Rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
HIPAA Security Rule
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Human oversight
Organizational and technical arrangements enabling qualified people to understand, monitor, challenge or stop an AI system as required by its risk and applicable law.
Context, practical use & authoritative sources
Practical significance
Assign named owners, escalation routes and tested override authority.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Americans with Disabilities Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
European Union Artificial Intelligence Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
FCA Consumer Duty
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Web Content Accessibility Guidelines
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
ICT concentration risk
concentration risk
Exposure created when multiple services or entities rely on a small set of ICT providers or on providers that are difficult to replace.
Context, practical use & authoritative sources
Practical significance
Map substitutability and common dependencies; a list of direct suppliers alone can miss concentration.
Definition context
EU DORA; overview and linked technical standards. Definitions below are explanatory summaries.
Official EIOPA overview and linked-standard index reviewed; direct EUR-Lex retrieval was restricted. Explanatory orientation, not clause-level validation.
Related financial-services research instruments
Digital Operational Resilience Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
ICT third-party risk
ICT supplier risk
Risk arising from reliance on externally provided information and communication technology services, including relevant subcontracting dependencies.
Context, practical use & authoritative sources
Practical significance
Identify concentration, access, continuity and exit risks through the service chain.
Definition context
EU DORA; overview and linked technical standards. Definitions below are explanatory summaries.
Official EIOPA overview and linked-standard index reviewed; direct EUR-Lex retrieval was restricted. Explanatory orientation, not clause-level validation.
Related financial-services research instruments
Digital Operational Resilience Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Impact containment
Resilience, Containment & Economic Abuse
Bound the operational, financial and physical consequences of a failed or manipulated workflow. Make interruption, isolation and safe recovery enforceable outside the agent.
Context, practical use & authoritative sources
Practical significance
Trigger a bounded retry storm and create a test child job. Withdraw the mandate. Verify spend and tool use stop across the chain, the child cannot restart it, and an authorized operator can restore a validated safe state.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST AI Risk Management Framework 1.0
author application context: An author-defined organizing concept applied to financial-sector AI oversight. Not NIST terminology or a binding requirement.
Impact tolerance
tolerance for disruption
The maximum tolerable level of disruption to an important business service under the applicable UK framework.
Context, practical use & authoritative sources
Practical significance
Distinguish the limit on tolerable harm from an internal recovery target; test severe but plausible scenarios.
Definition context
United Kingdom; FCA operational-resilience rules for firms in scope.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
FCA operational resilience rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
FCA Consumer Duty
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Important business service
IBS
A service provided to external users whose disruption could cause the harm identified by the applicable UK operational-resilience rules.
Context, practical use & authoritative sources
Practical significance
Identify the service as the customer experiences it, then map its people, processes, technology and dependencies.
Definition context
United Kingdom; FCA operational-resilience rules for firms in scope.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
FCA operational resilience rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
FCA Consumer Duty
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Importer (EU AI Act)
AI importer
An EU-established actor placing on the Union market an AI system bearing the name or trademark of an actor established outside the Union.
Context, practical use & authoritative sources
Practical significance
Analyze placement and branding instead of treating every cloud customer as an importer.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Inference
Using a trained model to produce an output from inputs. Ordinary inference does not necessarily update weights, but outputs can still change with context, sampling and external data.
Context, practical use & authoritative sources
Practical significance
Log the model version and consequential context without indiscriminately retaining sensitive payloads.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
HIPAA Privacy and Breach Notification Rules
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Intended purpose (EU AI Act)
intended use
The use envisaged by the provider, including the relevant context and conditions, as expressed in instructions, documentation and promotional or sales materials.
Context, practical use & authoritative sources
Practical significance
Reconcile marketing claims, instructions and actual deployment before classifying the system.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
International data transfer
A transfer of personal data subject to applicable cross-border rules, which may include remote access depending on the regime.
Context, practical use & authoritative sources
Practical significance
Identify the transfer mechanism, destination risks and supplementary measures where required.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Japan Act on the Protection of Personal Information
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
China Personal Information Protection Law
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Kill switch
emergency stop
A mechanism to interrupt an unsafe process. For agents, stopping the user interface alone may not stop child processes, credentials, scheduled jobs or external actions.
Context, practical use & authoritative sources
Practical significance
Test coordinated revocation and termination in an independent control domain.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
California September 2026 AI oversight executive direction
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Knowledge stewardship
Data, Retrieval & Memory Integrity
Govern source material, retrieved passages and persistent memory as related but distinct stores. Carry permissions, origin, quality and lifecycle obligations through their transformations.
Context, practical use & authoritative sources
Practical significance
Plant a benign test instruction in a retrieved document, revoke a source permission and inject a false memory into a test session. Confirm that action authority does not expand, access changes propagate and the memory can be identified and isolated.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST AI Risk Management Framework 1.0
author application context: An author-defined organizing concept applied to financial-sector AI oversight. Not NIST terminology or a binding requirement.
Lawful basis
The legal ground permitting a particular processing operation under the relevant data-protection regime. Consent is one possible basis, not a universal requirement or cure.
Context, practical use & authoritative sources
Practical significance
Record the basis separately for training, deployment, logging and onward sharing.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
General Data Protection Regulation
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
UK GDPR / Data Protection Act 2018 / DUAA 2025
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Least privilege
Granting only the permissions necessary for an authorized function, for an appropriate duration.
Context, practical use & authoritative sources
Practical significance
Apply it to agents, administrators, APIs and suppliers, with periodic review.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
MAS Technology Risk Management Guidelines
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
NIST SP800-53 Rev.5 - security and privacy controls
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Legal entity customer (CDD Rule)
legal-entity customer
A covered organization such as a corporation, limited liability company or general partnership opening an account, subject to the rule's exclusions.
Context, practical use & authoritative sources
Practical significance
Resolve legal form and exclusions instead of equating every business customer with a covered legal entity customer.
Definition context
US financial institutions; CDD rules and May 2026 updated FAQ. Entity-specific exceptions and relief apply.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
Bank Secrecy Act / AML program requirements
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Legitimate interests (EU GDPR)
legitimate interest assessment / LIA
A possible processing basis requiring a legitimate purpose, necessity and a balance against the individual's overriding interests, rights and freedoms.
Context, practical use & authoritative sources
Practical significance
Document the purpose and balancing assessment; it is not a general permission for any useful analytics.
Definition context
European Union GDPR; regulator guide rather than a replacement for statutory text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
General Data Protection Regulation
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Lifecycle accountability
Governance, Supply Chain & Lifecycle
Keep use cases, dependencies, obligations, control owners and material changes under accountable governance from procurement through retirement. Repeatable evidence supports decisions; it does not transfer accountability.
Context, practical use & authoritative sources
Practical significance
Change a model version, tool schema or upstream source. Verify that the material change triggers the required review and regression tests, including delegation, memory, action gates and evidence capture.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST SP 800-218A: AI-model secure development profile
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
CISA / international partners: SBOM for AI minimum elements
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
CISA: 2026 minimum elements for an SBOM
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Limited data set (HIPAA)
LDS
Protected health information from which specified direct identifiers have been removed, available under a compliant data use agreement for limited purposes.
Context, practical use & authoritative sources
Practical significance
A limited data set remains PHI; it is not automatically de-identified information or unrestricted training data.
Definition context
US HIPAA; 45 CFR 164.514. Legal exceptions and permitted purposes matter.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
HIPAA Privacy and Breach Notification Rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Material cybersecurity incident
material cyber incident
A cybersecurity incident determined material under applicable securities-law principles and the relevant disclosure framework.
Context, practical use & authoritative sources
Practical significance
Consider qualitative and quantitative effects; a severity label from a security tool is not the legal materiality determination.
Definition context
United States public-company reporting; materiality and filing duties are context-specific.
SEC official adoption summary supports orientation; use the operative rules and filing instructions for an actual issuer decision.
Related financial-services research instruments
SEC cybersecurity disclosure rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
SEC Regulation S-P
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Materiality
A threshold for significance under a particular legal, financial, safety or governance context. Different regimes can apply different tests.
Context, practical use & authoritative sources
Practical significance
Do not use a single technical severity score as every legal materiality decision.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
SEC cybersecurity disclosure rules
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Interagency model risk management guidance - SR26-2
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
OWASP Top 10 for Agentic Applications 2026
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Minimum necessary (HIPAA)
minimum-necessary standard
The requirement to reasonably limit specified uses, disclosures and requests to the PHI needed for their purpose, subject to stated exceptions.
Context, practical use & authoritative sources
Practical significance
Test access and retrieval limits; do not apply the rule mechanically where an exception governs.
Definition context
US HIPAA; 45 CFR 164.514. Legal exceptions and permitted purposes matter.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
HIPAA Privacy and Breach Notification Rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
ML-DSA
The Module-Lattice-Based Digital Signature Algorithm standardized in FIPS 204.
Context, practical use & authoritative sources
Practical significance
Use signatures within a verifiable trust and key-management system; a signed artifact can still be unsafe.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST post-quantum cryptography standards
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
ML-KEM
The Module-Lattice-Based Key-Encapsulation Mechanism standardized in FIPS 203 for establishing shared secret keys. It is not a digital signature algorithm.
Context, practical use & authoritative sources
Practical significance
Combine with an approved protocol, symmetric encryption and sound key lifecycle controls.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST post-quantum cryptography standards
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Model Context Protocol
MCP
An open protocol for connecting AI applications with tools, resources and prompts through defined client-server interactions. Compatibility does not establish trustworthiness of a server or tool.
Context, practical use & authoritative sources
Practical significance
Approve servers, scopes, authentication and input/output handling as supply-chain dependencies.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
MCP authorization specification (2026-07-28)
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Model evaluation
evals
Structured measurement of a model or system against defined tasks, criteria and conditions. Evaluation results are bounded by the tested population and environment.
Context, practical use & authoritative sources
Practical significance
Include adversarial, subgroup, operational and change-regression tests, not a single headline score.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Interagency model risk management guidance - SR26-2
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Model supply-chain compromise
Insertion or alteration of unsafe models, datasets, packages, adapters or tools through upstream dependencies.
Context, practical use & authoritative sources
Practical significance
Use provenance, integrity verification, version pinning and supplier assessment.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST SP 800-218A: AI-model secure development profile
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Money services business
MSB
An actor conducting one or more covered money-services activities under the BSA definition, subject to activity-specific thresholds and exceptions.
Context, practical use & authoritative sources
Practical significance
Determine each performed activity and the relevant registration, AML and reporting rules rather than relying solely on a NAICS label.
Definition context
US BSA; MSB categories, thresholds and exceptions depend on the activity.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
Bank Secrecy Act / AML program requirements
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Multi-factor authentication
MFA
Authentication using factors from different categories, such as something known, possessed or inherent to the subject. Two passwords do not constitute two factors.
Context, practical use & authoritative sources
Practical significance
Prefer phishing-resistant methods for material access and test bypass/recovery paths.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NYDFS Cybersecurity Regulation
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
PCI DSS v4.0.1
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Non-human identity
NHI / workload identity
An identity assigned to software, services, agents or devices rather than a person. It still needs an accountable human owner and a defined lifecycle.
Context, practical use & authoritative sources
Practical significance
Track issuance, purpose, privilege, delegation, rotation and revocation.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NCCoE: software and AI-agent identity and authorization
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Nonpublic information (NYDFS)
NYDFS NPI
The defined electronic business, identifying and health information protected by Part 500 when not publicly available.
Context, practical use & authoritative sources
Practical significance
Apply each statutory category; the term is broader than a shorthand list of customer personal data.
Definition context
New York Part 500 definitions; DFS labels this reading copy unofficial. Consult the operative compilation for legal reliance. These are not HIPAA or GLBA definitions.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
NYDFS Cybersecurity Regulation
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Notification event (FTC Safeguards Rule)
Safeguards notification event
Unauthorized acquisition of unencrypted customer information as defined by the rule, including its encryption-key and presumed-acquisition provisions.
Context, practical use & authoritative sources
Practical significance
Apply the separate notice threshold and timing requirements; do not equate this term with every detected incident.
Definition context
US FTC Safeguards Rule; entity and information scope are rule-specific.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
GLBA and FTC Safeguards Rule
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Notified body
notified assessment body
A conformity-assessment body formally notified under the applicable EU regime to perform specified third-party assessment activities.
Context, practical use & authoritative sources
Practical significance
Confirm designation and scope, not merely the assessor's brand or certification claims.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Observability
Ability to understand system behavior using outputs such as logs, metrics and traces. Visibility is not equivalent to effective detection or control.
Context, practical use & authoritative sources
Practical significance
Define which signals establish authority, outcome and control effectiveness.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
India CERT-In cybersecurity directions
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
OpenTelemetry GenAI span conventions
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Operating effectiveness
Whether a control is implemented and performs as intended over the relevant period or sample of operations.
Context, practical use & authoritative sources
Practical significance
Use current evidence rather than policy existence or vendor assertions alone.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
APRA CPS 234 - Information Security
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Opt-out preference signal
Global Privacy Control / GPC
A user-enabled signal communicating a privacy choice that an applicable rule requires covered businesses to recognize.
Context, practical use & authoritative sources
Practical significance
Test signal handling and downstream effect; the recognized technical and legal requirements vary.
Definition context
California CCPA/CPRA; official guidance, with statutory definitions and exceptions controlling.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
California Consumer Privacy Act / CPRA
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
California Delete Act / DROP data-broker deletion system
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Personal data
personal information
Information relating to an identified or identifiable person under the applicable legal definition. Identifiability can be indirect and depends on context and available means.
Context, practical use & authoritative sources
Practical significance
Assess inference, linkage and metadata, not only names or account numbers.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
California Consumer Privacy Act / CPRA
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Connecticut Data Privacy Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Texas Data Privacy and Security Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Fair Credit Reporting Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Privacy and Electronic Communications Regulations
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
PIPEDA
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Australian Privacy Act and Australian Privacy Principles
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Singapore Personal Data Protection Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Japan Act on the Protection of Personal Information
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
India Digital Personal Data Protection Act and Rules
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
South Africa Protection of Personal Information Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Swiss Federal Act on Data Protection
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
New Zealand Privacy Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Quebec private-sector privacy law (Law 25 reforms)
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Singapore PDPC guidance on AI use of personal data
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
China Personal Information Protection Law
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
China Data Security Law
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
China Interim Measures for Generative AI Services
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Brazil General Personal Data Protection Law
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Personal data breach
A security breach leading to accidental or unlawful destruction, loss, alteration, disclosure of or access to personal data under the applicable definition.
Context, practical use & authoritative sources
Practical significance
Assess notification triggers and clocks separately for each affected jurisdiction and sector.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
New York SHIELD Act and breach notification
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
SEC Regulation S-P
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
New Zealand Privacy Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Plan of action and milestones
POA&M / POAM
A managed record of identified weaknesses, planned corrective actions, resources, milestones and completion dates.
Context, practical use & authoritative sources
Practical significance
Track evidence of remediation and independent retest; do not treat the plan as remediation itself.
Definition context
NIST technical/control vocabulary; binding force depends on adoption, law or contract.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
NIST SP800-53 Rev.5 - security and privacy controls
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
NIST Cybersecurity Framework
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST Privacy Framework - final 1.0 / draft 1.1
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST SSDF - SP800-218 v1.1 / v1.2 draft
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST incident response recommendations
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Post-market monitoring system
post-market monitoring
Provider activities to collect and evaluate operating experience after market placement or service entry, so necessary corrective or preventive action can be identified.
Context, practical use & authoritative sources
Practical significance
Define data sources, escalation thresholds, accountable owners and evidence retention after deployment.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Post-quantum cryptography
PQC
Cryptographic algorithms designed to resist known attacks by both conventional and quantum computers. The term concerns algorithmic security, not immunity of an entire system.
Context, practical use & authoritative sources
Practical significance
Inventory dependencies, plan migration and validate protocol and implementation support.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST post-quantum cryptography standards
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Privacy impact assessment
PIA
A broader assessment of how information processing affects privacy and how resulting risks should be managed. Legal forms and triggers vary.
Context, practical use & authoritative sources
Practical significance
Include inference, surveillance and inappropriate use even without a security breach.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Quebec private-sector privacy law (Law 25 reforms)
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
NIST Privacy Framework - final 1.0 / draft 1.1
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Profiling
Automated processing that evaluates personal aspects such as behavior, preferences or performance, within the applicable legal definition.
Context, practical use & authoritative sources
Practical significance
Assess discriminatory effects, transparency and secondary use of inferred attributes.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Virginia Consumer Data Protection Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Colorado Privacy Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Privacy and Electronic Communications Regulations
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Prompt
Instructions or other input supplied to a model, potentially including user text, system messages, examples and retrieved material. Prompt content is not a substitute for external access control.
Context, practical use & authoritative sources
Practical significance
Treat prompts as controlled inputs and protect sensitive material included in them.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
OpenTelemetry GenAI span conventions
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Prompt injection
An attempt to make an AI system follow unauthorized instructions supplied in a prompt or in material it processes. It can redirect outputs or tool use without changing model weights.
Context, practical use & authoritative sources
Practical significance
Treat untrusted content as data and enforce consequential restrictions outside the model.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
OWASP AI security guidance
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Protected health information
PHI / ePHI
Individually identifiable health information within HIPAA's defined scope and exceptions; ePHI is its electronic form. Not all health-related data is HIPAA-covered.
Context, practical use & authoritative sources
Practical significance
Identify covered-entity or business-associate status and applicable non-HIPAA rules.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
HIPAA Privacy and Breach Notification Rules
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
HIPAA Security Rule
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Provider (EU AI Act)
AI provider
The actor that develops an AI system or general-purpose AI model, or has it developed, and places it on the market or puts the system into service under its own name or trademark.
Context, practical use & authoritative sources
Practical significance
Determine the actual legal role; a purchaser may assume provider obligations after specified changes or rebranding.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Public-interest task
public task
Processing necessary for a task in the public interest or exercise of official authority vested in the controller under the required legal basis.
Context, practical use & authoritative sources
Practical significance
Identify the law conferring the task; being beneficial to the public does not alone establish the ground.
Definition context
European Union GDPR; regulator guide rather than a replacement for statutory text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
General Data Protection Regulation
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Purpose limitation
Restricting collection and subsequent processing to specified, legitimate purposes, with rules governing compatible reuse.
Context, practical use & authoritative sources
Practical significance
Assess whether reusing operational data for training introduces a new purpose.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Singapore Personal Data Protection Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Qualified Individual (FTC Safeguards Rule)
Qualified Individual
The person designated to oversee, implement and enforce the institution's information-security program under the rule.
Context, practical use & authoritative sources
Practical significance
Document competence, reporting, service-provider arrangements and retained institutional responsibility.
Definition context
US FTC Safeguards Rule; 16 CFR 314.4.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
GLBA and FTC Safeguards Rule
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Ransomware
Malicious activity that denies access, encrypts data or combines disruption with extortion, often including data theft.
Context, practical use & authoritative sources
Practical significance
Exercise restoration, isolation, evidence preservation and decision authority before an incident.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Cyber Incident Reporting for Critical Infrastructure Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Reasonably foreseeable misuse
foreseeable misuse
Use outside an AI system's intended purpose that can reasonably follow from predictable human behavior or interaction with other systems.
Context, practical use & authoritative sources
Practical significance
Include realistic misuse in scenario testing without suggesting that every conceivable abuse is foreseeable.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Recognised legitimate interest (UK)
recognized legitimate interest
A separate UK processing basis introduced by DUAA for specified recognized purposes, subject to its statutory conditions.
Context, practical use & authoritative sources
Practical significance
Keep this distinct from the ordinary purpose-necessity-balancing analysis; do not export the UK basis into EU GDPR advice.
Definition context
United Kingdom; UK GDPR guidance updated for DUAA.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
UK GDPR / Data Protection Act 2018 / DUAA 2025
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Recovery
Restoring operations to an acceptable, validated state after disruption or compromise, including monitoring for recurrence.
Context, practical use & authoritative sources
Practical significance
Require evidence of restored integrity and control before resuming consequential AI actions.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NYDFS Cybersecurity Regulation
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
OSFI B-13 - technology and cyber risk
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
MAS Technology Risk Management Guidelines
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
NIST incident response recommendations
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Recovery time objective
RTO
The target elapsed time for restoring a system or capability after disruption, as defined by the recovery plan.
Context, practical use & authoritative sources
Practical significance
Verify that the entire process, including dependencies and human decisions, meets the target.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
FCA operational resilience rules
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Register of information (DORA)
RoI
The structured record of contractual arrangements for ICT services required for the relevant entity, sub-consolidated and consolidated levels.
Context, practical use & authoritative sources
Practical significance
Use the applicable templates; a generic supplier spreadsheet may omit required identifiers and service relationships.
Definition context
EU DORA; overview and linked technical standards. Definitions below are explanatory summaries.
Official EIOPA overview and linked-standard index reviewed; direct EUR-Lex retrieval was restricted. Explanatory orientation, not clause-level validation.
Related financial-services research instruments
Digital Operational Resilience Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Remote biometric identification
RBI
Identification without a person's active involvement, typically at a distance, by comparing biometric data with a reference database.
Context, practical use & authoritative sources
Practical significance
Assess real-time versus post-event use and sector-specific restrictions; a camera alone does not establish this classification.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Residual risk
Risk remaining after implemented controls or responses, subject to their actual effectiveness and uncertainty.
Context, practical use & authoritative sources
Practical significance
Identify who may accept it and what conditions trigger reconsideration.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
ISO/IEC 23894 AI risk management
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
NIST AI Risk Management Framework 1.0
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Right to correct
rectification request
An individual's ability under an applicable privacy law to request correction of inaccurate personal information, subject to its scope and verification rules.
Context, practical use & authoritative sources
Practical significance
Trace corrections into relevant systems and derived records; check each jurisdiction's exceptions.
Definition context
California CCPA/CPRA; official guidance, with statutory definitions and exceptions controlling.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
California Consumer Privacy Act / CPRA
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
California Delete Act / DROP data-broker deletion system
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Safe Harbor de-identification (HIPAA)
HIPAA Safe Harbor
A de-identification route requiring removal of listed identifiers and no actual knowledge that remaining information can identify an individual.
Context, practical use & authoritative sources
Practical significance
Validate every required removal; replacing names alone is not this method.
Definition context
US HIPAA; 45 CFR 164.514. Legal exceptions and permitted purposes matter.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
HIPAA Privacy and Breach Notification Rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Sale of personal information (CCPA)
CCPA sale
A defined exchange or making available of personal information for monetary or other valuable consideration, subject to statutory exceptions.
Context, practical use & authoritative sources
Practical significance
Evaluate the actual recipient arrangement and exception conditions; absence of a cash payment does not settle the question.
Definition context
California CCPA/CPRA; official guidance, with statutory definitions and exceptions controlling.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
California Consumer Privacy Act / CPRA
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
California Delete Act / DROP data-broker deletion system
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
SAR confidentiality
SAR nondisclosure
Restrictions protecting a suspicious activity report and information that would reveal its existence, subject to permitted disclosures.
Context, practical use & authoritative sources
Practical significance
Keep SAR information out of unapproved AI services and avoid implying that every underlying business record is itself secret merely because a SAR exists.
Definition context
US BSA reporting; the cited overview concerns specified MSB activities. Different institutions have different triggers.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
Bank Secrecy Act / AML program requirements
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Senior governing body (NYDFS)
senior governing body
The board, appropriate committee or equivalent governing body, with specified alternatives where no such body exists and for adopted affiliate programs.
Context, practical use & authoritative sources
Practical significance
Identify who receives reporting and exercises oversight; delegation does not erase the defined responsibilities.
Definition context
New York Part 500; DFS reading copy, not the official compilation. Defined terms are not interchangeable with other regimes.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
NYDFS Cybersecurity Regulation
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Interagency third-party relationship risk management
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Sensitive personal data
special-category data
Personal information subject to heightened protection under an applicable law. Categories differ; GDPR special categories include health, genetics and specified biometric or belief-related data.
Context, practical use & authoritative sources
Practical significance
Do not transplant one jurisdiction's category list or legal basis into another.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Connecticut Data Privacy Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
China Personal Information Protection Law
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
General Data Protection Regulation
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
UK GDPR / Data Protection Act 2018 / DUAA 2025
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Serious incident (EU AI Act)
AI serious incident
An AI-system incident or malfunction leading to specified serious consequences for health, critical infrastructure, fundamental-rights obligations, property or the environment.
Context, practical use & authoritative sources
Practical significance
Assess the Act's categories and reporting rules; this is not interchangeable with every cyber alert or other laws' incident definitions.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Service provider (CCPA)
CCPA service provider
An entity processing personal information for a business under the CCPA's contract, purpose and use restrictions.
Context, practical use & authoritative sources
Practical significance
Do not equate any vendor or GDPR processor with a qualifying CCPA service provider.
Definition context
California CCPA/CPRA; official guidance, with statutory definitions and exceptions controlling.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
California Consumer Privacy Act / CPRA
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
California Delete Act / DROP data-broker deletion system
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Severe but plausible scenario
severe-but-plausible testing
A challenging but credible disruption used to assess resilience against the relevant service impact tolerance.
Context, practical use & authoritative sources
Practical significance
Document the scenario assumptions and response evidence instead of selecting only easy-to-pass tests.
Definition context
United Kingdom; FCA operational-resilience rules for firms in scope.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
FCA operational resilience rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
FCA Consumer Duty
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Sharing (CCPA)
CCPA sharing
Making personal information available for cross-context behavioral advertising as defined by the CCPA, whether or not payment is involved.
Context, practical use & authoritative sources
Practical significance
Distinguish sharing in this specific sense from ordinary internal data sharing.
Definition context
California CCPA/CPRA; official guidance, with statutory definitions and exceptions controlling.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
California Consumer Privacy Act / CPRA
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
California Delete Act / DROP data-broker deletion system
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Significant Data Fiduciary
SDF
A Data Fiduciary or class notified by India's Central Government under the statutory designation process.
Context, practical use & authoritative sources
Practical significance
Do not self-assign this status based solely on company size or presume designation without the relevant notification.
Definition context
India DPDP Act 2023; Section 2. Definitions do not establish commencement of every substantive duty.
Section 2 of the official Gazette PDF was read. This is a definition review, not a current consolidated-law or commencement audit; phased duties require separate checking.
Related financial-services research instruments
India Digital Personal Data Protection Act and Rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
SLH-DSA
A stateless hash-based digital signature algorithm standardized in FIPS 205, with different performance and security-design tradeoffs from ML-DSA.
Context, practical use & authoritative sources
Practical significance
Evaluate artifact size, signing cost and interoperability against the assurance use case.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST post-quantum cryptography standards
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Software bill of materials
SBOM
A structured inventory describing software components and their relationships. It enables transparency but is not itself evidence that software is secure.
Context, practical use & authoritative sources
Practical significance
Link the inventory to version, vulnerability, supplier and runtime evidence.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST SP 800-218A: AI-model secure development profile
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
CISA / international partners: SBOM for AI minimum elements
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
CISA: 2026 minimum elements for an SBOM
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Software composition analysis
SCA
Analysis of third-party software components and dependencies for issues such as known vulnerabilities and licensing obligations.
Context, practical use & authoritative sources
Practical significance
Track transitive dependencies and deployment context alongside component lists.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST SSDF - SP800-218 v1.1 / v1.2 draft
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
CISA: 2026 minimum elements for an SBOM
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Special categories of personal data
special-category data
The sensitive categories identified by GDPR Article 9, whose processing requires an applicable Article 9 condition as well as a lawful basis where required.
Context, practical use & authoritative sources
Practical significance
Distinguish this list from criminal-offence data and from another jurisdiction's sensitive-data definition.
Definition context
European Union GDPR; regulator guide rather than a replacement for statutory text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
General Data Protection Regulation
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Specified purpose (India DPDP)
specified purpose
The purpose stated in the notice given by the Data Fiduciary in accordance with the DPDP Act and its rules.
Context, practical use & authoritative sources
Practical significance
Align the notice with actual processing and separately check commencement and any permitted-use provision.
Definition context
India DPDP Act 2023; Section 2. Definitions do not establish commencement of every substantive duty.
Section 2 of the official Gazette PDF was read. This is a definition review, not a current consolidated-law or commencement audit; phased duties require separate checking.
Related financial-services research instruments
India Digital Personal Data Protection Act and Rules
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Storage limitation
retention
Keeping identifiable personal data only as long as justified by purpose and applicable obligations, subject to specific lawful exceptions.
Context, practical use & authoritative sources
Practical significance
Set deletion triggers, legal-hold exceptions and backup handling rather than retaining everything indefinitely.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
California Consumer Privacy Act / CPRA
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Illinois Biometric Information Privacy Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Colorado automated decisionmaking law - SB26-189
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
SEC Regulation S-P
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Quebec private-sector privacy law (Law 25 reforms)
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Singapore Personal Data Protection Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
India CERT-In cybersecurity directions
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
New Zealand Privacy Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
OpenTelemetry GenAI span conventions
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Substantial modification (EU AI Act)
substantial change
An unplanned change after market placement or service entry that affects compliance with high-risk requirements or changes the assessed intended purpose.
Context, practical use & authoritative sources
Practical significance
Review model, tool and purpose changes against the legal test; not every software update qualifies.
Definition context
EU AI Act; Article 3 definitions. Commission display; consult the operative legal text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
European Union Artificial Intelligence Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Suspicious activity report
SAR
A regulated report to FinCEN about activity meeting the applicable institution-specific suspicion, transaction and reporting criteria.
Context, practical use & authoritative sources
Practical significance
A monitoring alert is not itself a SAR. Keep human review, rationale and filing responsibility explicit when AI assists.
Definition context
US BSA reporting; the cited overview concerns specified MSB activities. Different institutions have different triggers.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
Bank Secrecy Act / AML program requirements
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
System security plan
SSP
A document describing the system, its security requirements and the controls in place or planned to meet them.
Context, practical use & authoritative sources
Practical significance
Align the plan with the actual authorization boundary and deployed configuration.
Definition context
NIST technical/control vocabulary; binding force depends on adoption, law or contract.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
NIST SP800-53 Rev.5 - security and privacy controls
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
NIST Cybersecurity Framework
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST Privacy Framework - final 1.0 / draft 1.1
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST SSDF - SP800-218 v1.1 / v1.2 draft
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
NIST incident response recommendations
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Tactics, techniques and procedures
TTPs
Tactics describe adversary objectives, techniques how they are pursued, and procedures their concrete implementations.
Context, practical use & authoritative sources
Practical significance
Map detection and testing to relevant behavior rather than relying only on static indicators.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
MITRE ATLAS
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Third-party service provider (NYDFS)
TPSP
A non-affiliate, non-governmental service provider meeting Part 500's conditions, including access to nonpublic information through its services.
Context, practical use & authoritative sources
Practical significance
Review subcontracted AI and technology arrangements against the definition rather than every vendor in accounts payable.
Definition context
New York Part 500; DFS reading copy, not the official compilation. Defined terms are not interchangeable with other regimes.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
NYDFS Cybersecurity Regulation
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Interagency third-party relationship risk management
research context: Related governance topic, not a definition supplied by this instrument. Use the term source and this instrument independently; thresholds and legal meanings can differ.
Threat
A circumstance or event with potential to adversely affect operations, assets or individuals through unauthorized access, disruption, disclosure or other harm.
Context, practical use & authoritative sources
Practical significance
Separate the threat from the vulnerability it could exploit.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST Generative AI Profile
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
OWASP AI security guidance
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
MITRE ATLAS
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Threat modeling
Structured analysis of assets, architecture, trust boundaries, threats and controls before and during system development.
Context, practical use & authoritative sources
Practical significance
Model unsafe authorized actions as well as external intrusion.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
NIST SSDF - SP800-218 v1.1 / v1.2 draft
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
OWASP AI security guidance
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Threat-led penetration testing
TLPT
A controlled assessment using threat intelligence to test relevant live production systems and functions under the prescribed DORA framework for selected entities.
Context, practical use & authoritative sources
Practical significance
Require scope, safeguards, qualified testers and oversight; this is not a routine vulnerability scan.
Definition context
EU DORA; overview and linked technical standards. Definitions below are explanatory summaries.
Official EIOPA overview and linked-standard index reviewed; direct EUR-Lex retrieval was restricted. Explanatory orientation, not clause-level validation.
Related financial-services research instruments
Digital Operational Resilience Act
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Token
A unit used by a model's tokenizer, which may represent part of a word, a whole word, punctuation or another encoded element. Token counts are not the same as word counts.
Context, practical use & authoritative sources
Practical significance
Test input-length handling and avoid assuming that character limits equal model limits.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
MCP authorization specification (2026-07-28)
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Training
Fitting a model's parameters or decision structure using data, objectives and an optimization process. It is distinct from simply sending a request to an already deployed model.
Context, practical use & authoritative sources
Practical significance
Retain data provenance, training configuration, evaluation results and release approval.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
China Interim Measures for Generative AI Services
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Transparency
Making appropriate information about AI purpose, operation, limitations and governance available to relevant parties.
Context, practical use & authoritative sources
Practical significance
Balance disclosure with privacy, security and legitimate confidentiality.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
FTC Act, Section 5
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Colorado automated decisionmaking law - SB26-189
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
OECD AI Principles
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
California Transparency in Frontier Artificial Intelligence Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
California AI Transparency Act - SB942, AB853 and 2026 amendments
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
New York Responsible AI Safety and Education (RAISE) Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
European Union Artificial Intelligence Act
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Quebec private-sector privacy law (Law 25 reforms)
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
China Personal Information Protection Law
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Brazil General Personal Data Protection Law
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
California AB1405 - AI auditor registry and independence
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Validation
Assessing whether a system, model or process is suitable for its intended purpose in the relevant context.
Context, practical use & authoritative sources
Practical significance
Validate business consequences and affected populations, not only technical correctness.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
FTC Act, Section 5
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Title VII and employment discrimination
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Interagency model risk management guidance - SR26-2
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Fair Credit Reporting Act
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
US economic sanctions / OFAC compliance
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Verification
Checking whether specified requirements have been met, often by inspection or testing.
Context, practical use & authoritative sources
Practical significance
Do not confuse compliance with a specification with fitness for the real-world use.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
Web Content Accessibility Guidelines
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
California SB813 - independent AI verification organizations
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
California September 2026 AI oversight executive direction
research context: Curated concept relevant to reading this instrument. The instrument does not necessarily define this term, and this is not an applicability finding.
Vital interests
vital-interest basis
A lawful-processing ground associated with protecting a person's life or essential interests, within the law's conditions.
Context, practical use & authoritative sources
Practical significance
Do not treat ordinary commercial importance or convenience as vital interests.
Definition context
European Union GDPR; regulator guide rather than a replacement for statutory text.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
General Data Protection Regulation
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Vulnerability
A weakness in a system, process or control that a threat could exploit or that could lead to adverse outcomes.
Context, practical use & authoritative sources
Practical significance
Prioritize exploitability, exposure and business impact, not score alone.
Paraphrased research definition. Consult the stated source and context before reliance.
Related financial-services research instruments
PCI DSS v4.0.1
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
FCA Consumer Duty
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
NIST SSDF - SP800-218 v1.1 / v1.2 draft
narrative vocabulary: This phrase appears in the library synopsis; the link is a vocabulary aid, not a claim that this instrument supplies the definition.
Written information security program
WISP
A documented program of administrative, technical and physical safeguards designed for the institution's risks and the applicable rule's requirements.
Context, practical use & authoritative sources
Practical significance
A policy document without operating safeguards and evidence is not the whole program.
Definition context
US FTC Safeguards Rule; 16 CFR 314.4.
Available official text or regulator explanation reviewed; paraphrase, not a full legal opinion.
Related financial-services research instruments
GLBA and FTC Safeguards Rule
definition context: Definition/explanation is scoped to the cited authority. Verify the precise source section, entity role and applicable text.
Financial-services regulatory library
I connect AI, cyber and privacy obligations to the financial activity, accountable decision and evidence that matter. This public edition covers Financial services & insurance, including relevant international and cross-sector research.
How to navigate / scope and jurisdiction cautions
Choose a financial activity, then refine by issuing region, jurisdiction and instrument. The remaining filter choices are drawn only from the selected financial research set. No result means no mapped public match, not an exemption.
NAICS is an activity-navigation aid, not a legal-applicability test. A banking charter, MSB registration and insurance license differ. Headquarters alone does not determine applicable law; assess entity, activities, customers, data, product, territorial nexus and local implementation. Shared frameworks remain available when relevant. HIPAA appears where the inherited insurance/PBM activity mapping calls for it.
Public records retain their own review dates and limitations. This access revision is not a new legal-source audit. Read the official source before relying on a summary. The preview can be read and copied; it is not a subscriber database.
More below: choose filters, then scroll to the matching references.
86 public financial-services records. JavaScript adds filtering; the readable public subset follows.
FTC Act, Section 5
Businesses within Federal Trade Commission jurisdiction. Sectoral exemptions and the distinction between commercial conduct and regulated banking or nonprofit activity matter.
Duties, evidence, limitations & official sources
Status / timing
In force; case-specific enforcement
Duties / expectations
Prohibits unfair or deceptive acts or practices. AI performance, privacy, security and bias representations must match actual practices; using AI does not displace consumer-protection duties.
Evidence to consider
Maintain substantiation for public claims, tested security/privacy controls, complaint handling and documented corrective action. Evaluate actual consumer injury rather than relying on an AI label.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
15 USC 45
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsCalifornia Consumer Privacy Act / CPRA
For-profit businesses meeting statutory California thresholds; service-provider and contractor duties differ. Exemptions are often data-specific, not blanket exemptions for an entire enterprise.
Duties, evidence, limitations & official sources
Status / timing
CCPA/CPRA in force; 2025 final regulations effective January 1, 2026 with later compliance/submission dates
Duties / expectations
Includes notice, access, correction, deletion, sale/sharing opt-out and sensitive-information protections, subject to statutory scope and exceptions. Covered risk-assessment duties begin January 1, 2026, with assessment attestations and summaries due April 1, 2028. Covered ADMT requirements begin January 1, 2027. Initial cybersecurity-audit certifications are phased to April 1 of 2028, 2029 or 2030 according to the applicable revenue tier.
Evidence to consider
Data/use inventory; verified request workflow; opt-out signals; purpose/retention limits; vendor contracts; risk-assessment and audit applicability records.
Scope qualification
First determine whether each activity and audit/ADMT threshold is in scope. Revenue tiers determine the schedule only after audit applicability is established; exemptions are often data-specific rather than entity-wide.
Source locator
California Civil Code 1798.100 et seq.
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
New York SHIELD Act and breach notification
Persons and businesses holding covered private information of New York residents; reasonable-security duties and notification triggers should be assessed separately.
Duties, evidence, limitations & official sources
Status / timing
In force
Duties / expectations
Requires reasonable administrative, technical and physical safeguards and notifications for qualifying breaches. Outsourcing data handling does not eliminate safeguarding responsibilities.
Evidence to consider
Data classification, risk assessment, supplier diligence, safeguards testing, disposal schedules and incident notification decision records.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
GBL 899-aa and 899-bb
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsVirginia Consumer Data Protection Act
Controllers meeting Virginia resident-data or revenue thresholds, subject to statutory entity and data exemptions.
Duties, evidence, limitations & official sources
Status / timing
In force
Duties / expectations
Requires notices, consumer rights, processor contracts and assessments for specified high-risk processing, including certain profiling. Sensitive-data consent and appeals requirements require operational workflows.
Evidence to consider
Processing inventory, rights/appeal case records, purpose limits, processor agreements and documented assessments.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Title 59.1, Chapter 53
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsColorado Privacy Act
Controllers meeting statutory coverage tests with Colorado nexus; not every small business or employment record falls in scope.
Duties, evidence, limitations & official sources
Status / timing
In force; distinct from Colorado AI legislation
Duties / expectations
Regulates consumer rights, sensitive data, targeted advertising and high-risk processing. Covered controllers must honor applicable universal opt-out mechanisms and complete required data-protection assessments.
Evidence to consider
Data inventory, consent/opt-out evidence, profiling reviews, consumer appeals and vendor processing terms.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Colorado Revised Statutes 6-1-1301 et seq.
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsConnecticut Data Privacy Act
Covered controllers processing Connecticut resident data; thresholds, exemptions and child/teen protections must be evaluated under the current text.
Duties, evidence, limitations & official sources
Status / timing
In force; consult amended coverage and youth provisions
Duties / expectations
Creates consumer rights, consent and security duties, processor obligations and assessments for designated risky processing. Opt-out mechanisms and sensitive-data handling are important to AI personalization.
Evidence to consider
Rights and consent records, assessments, data-purpose controls, deletion propagation and supplier evidence.
Scope qualification
July 1, 2026 amendments broaden coverage to specified controllers processing at least 35,000 consumers, selling personal data or processing sensitive data, subject to exclusions. Review the amended youth, neural-data and other sensitive-data provisions rather than an older threshold summary.
Source locator
Connecticut General Statutes 42-515 et seq.
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsTexas Data Privacy and Security Act
Persons conducting business in Texas or producing products/services consumed by residents, subject to small-business and other statutory exclusions and exceptions.
Duties, evidence, limitations & official sources
Status / timing
In force; separate from Texas AI law
Duties / expectations
Requires consumer rights, notices, reasonable security, processor contracts and assessments for specified processing; sensitive-data sale restrictions can reach otherwise exempt small businesses.
Evidence to consider
Coverage memo, privacy notices, rights/appeal workflows, opt-out handling and high-risk processing assessments.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Business & Commerce Code Chapter 541
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsIllinois Biometric Information Privacy Act
Private entities collecting or holding covered biometric identifiers/information, with statutory exclusions. Face recognition and voiceprint applications need classification beyond ordinary photos/audio.
Duties, evidence, limitations & official sources
Status / timing
In force; amended liability provisions require current-text review
Duties / expectations
Requires informed written release for covered collection, a public retention/destruction policy, restrictions on disclosure/profit and protective handling. Private litigation exposure is distinct from general privacy laws.
Evidence to consider
Biometric purpose/retention policy, releases, vendor disclosures, destruction logs and security evidence.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
740 ILCS 14
Review limitation
October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.
Explore related financial-services termsTitle VII and employment discrimination
Covered employers, employment agencies and labor organizations. AI recruitment, assessment, promotion and termination tools remain employment-selection practices.
Duties, evidence, limitations & official sources
Status / timing
In force
Duties / expectations
Prohibits specified discrimination. Assess disparate treatment and legally cognizable disparate impact under governing law; no vendor assurance substitutes for employer responsibility.
Evidence to consider
Job-related validation, selection-rate analysis, accommodation/escalation channels, vendor testing rights and decision records.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
42 USC 2000e et seq.
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsAmericans with Disabilities Act
Covered employers, public entities and public accommodations under the relevant ADA title. Disability-sensitive algorithmic screening and digital accessibility need separate assessments.
Duties, evidence, limitations & official sources
Status / timing
In force
Duties / expectations
Prohibits disability discrimination and establishes applicable accommodation/access obligations. Test whether automated assessments screen out qualified people or inaccessible interfaces prevent participation.
Evidence to consider
Accessibility and accommodation procedures, validated selection criteria, alternative assessments and complaint resolution.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
ADA Titles I, II and III as applicable
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsNew York City Local Law 144 - automated employment decisions
Employers and employment agencies using an AEDT within the law and rules' definition and geographic scope; not every workplace AI tool qualifies.
Duties, evidence, limitations & official sources
Status / timing
Enforced since July 5, 2023
Duties / expectations
Requires an independent bias audit within one year, public availability of required audit information and candidate/employee notices before covered use.
Evidence to consider
AEDT scope analysis, audit independence and methodology, published summary, notice evidence and periodic review.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Local Law 144 of 2021
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsTexas Responsible Artificial Intelligence Governance Act
Entities and AI systems within Texas jurisdiction as defined; government, healthcare and other provisions have differing scopes. Do not confuse this with TDPSA.
Duties, evidence, limitations & official sources
Status / timing
Effective January 1, 2026
Duties / expectations
Prohibits specified harmful/manipulative and unlawful discriminatory uses; includes targeted disclosure and enforcement provisions. This is not a universal mandate that every AI user obtain certification.
Evidence to consider
Use-case screening, prohibited-use controls, disclosure review, documented intent/purpose and provider/deployer responsibility allocation.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
HB 149, 89th Legislature
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsColorado automated decisionmaking law - SB26-189
Developers and deployers of covered automated decisionmaking technology used for consequential decisions, subject to defined exclusions and exceptions.
Duties, evidence, limitations & official sources
Status / timing
Enacted; operative January 1, 2027; replaces SB24-205 framework
Duties / expectations
Requires relevant technical documentation, notices and consumer review/reconsideration procedures; distinguishes developer and deployer duties. Preserve required decision records and evaluate the amended scope rather than relying on old SB24-205 summaries.
Evidence to consider
Coverage register, technical documentation, human-review process, notices, material-update tracking and record retention.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
SB26-189
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsCalifornia Transparency in Frontier Artificial Intelligence Act
Frontier developers and large frontier developers meeting statutory model/developer thresholds. Not a general certification requirement for enterprise AI users.
Duties, evidence, limitations & official sources
Status / timing
In force; frontier-developer and large-frontier-developer classifications control
Duties / expectations
Requires covered safety frameworks, transparency disclosures, critical-safety-incident reporting and whistleblower protections. Disclosure duties differ by developer category.
Evidence to consider
Frontier-model threshold assessment, approved framework, evaluation records, release disclosures, incident reporting procedure and protected employee reporting.
Scope qualification
The Attorney General describes framework, incident and employee-reporting provisions. Separate the developer categories; this is not a general certification obligation for every enterprise using an AI tool.
Source locator
Business & Professions Code 22757.10 et seq.; Labor Code 1107 and 1107.1
Review limitation
Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.
California AI Transparency Act - SB942, AB853 and 2026 amendments
Generative-AI providers and staged platform/hosting/device requirements. The Governor confirms signing SB1000 and AB2713 on September 30, 2026, further amending the transparency regime. Do not rely on the older provider definition or user threshold without checking the amended text.
Duties, evidence, limitations & official sources
Status / timing
Operative statute; September 30, 2026 amendments require consolidated-text review before reliance
Duties / expectations
The regime addresses synthetic-content provenance, disclosures and verification/detection capabilities, with actor-specific requirements. AB853 introduced a chapter-wide August 2, 2026 operative date and staged platform/device requirements. The September 2026 legislation further changes the regime. The chaptered/consolidated text was not retrievable in this review, so exact amended thresholds, exceptions and commencement details remain an explicit validation item.
Evidence to consider
Provider/platform classification, provenance tests, disclosure persistence, detection access and staged implementation records.
Scope qualification
Publication boundary: enactment and the subject of the amendments are supported by the official signing announcement. This entry does not certify the post-September 30 requirements or assume that all original SB942 duties remain unchanged.
Source locator
Business & Professions Code Chapter 25; SB942 / AB853; SB1000 and AB2713 (2026)
Review limitation
Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.
New York Responsible AI Safety and Education (RAISE) Act
Frontier and large frontier developers within Article 44-B definitions and scope; applicability is not equivalent to deploying any enterprise LLM.
Duties, evidence, limitations & official sources
Status / timing
Enacted; operative January 1, 2027
Duties / expectations
Creates transparency, safety-incident reporting, disclosure and related accountability obligations. Use the amended consolidated law rather than an earlier bill version.
Evidence to consider
Compute/revenue threshold analysis, safety framework, disclosure approvals, critical-incident escalation and preservation of evaluation evidence.
Scope qualification
Article 44-B applies to defined large developers and covered frontier models, not every New York AI user. Confirm statutory thresholds, exemptions and implementing directions before treating an enterprise deployment as covered.
Source locator
GBL 1420-1429
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsNYDFS Cybersecurity Regulation
Entities operating under covered NY financial-services laws; limited exemptions and Class A requirements require a documented scope determination.
Duties, evidence, limitations & official sources
Status / timing
In force; amended requirements and exemptions apply
Duties / expectations
Requires a risk-based cybersecurity program, policies, CISO/governing-body oversight, controls, incident reporting and annual compliance submission. AI data flows and suppliers belong in the risk assessment.
Evidence to consider
Board reporting, asset inventory, risk assessment, control tests, MFA/PAM evidence, incident decisions, recovery tests and third-party reviews.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
23 NYCRR Part 500
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsGLBA and FTC Safeguards Rule
Financial institutions subject to the FTC's GLBA jurisdiction, including covered nonbank financial activities. Banking-agency rules govern other covered institutions.
Duties, evidence, limitations & official sources
Status / timing
In force
Duties / expectations
Requires a written security program led by a qualified individual, risk assessment, safeguards, service-provider oversight and reporting. Specific notification duties have their own trigger.
Evidence to consider
Written program, governing-body reports, inventory, encryption/MFA rationale, testing, supplier monitoring and incident-notification record.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
16 CFR 314
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsSEC Regulation S-P
Covered broker-dealers, funding portals, investment companies, SEC-registered investment advisers and covered transfer agents. Size classifications differ by registrant type; the adviser AUM threshold is not a universal threshold for all entities.
Duties, evidence, limitations & official sources
Status / timing
2024 amendments: larger entities December 3, 2025; smaller entities June 3, 2026; both dates elapsed
Duties / expectations
Requires written incident-response policies, safeguards/disposal, service-provider oversight and compliance records. Covered notification is due as soon as practicable, generally no later than 30 days after awareness of the triggering unauthorized access/use, subject to the rule's investigation-based exception and authorized delay provisions. Do not equate every security alert with the notification trigger.
Evidence to consider
Incident-response program, affected-information analysis, notice decisions, service-provider records, retention and supervisory review.
Scope qualification
Verify the affected information and covered individuals before deciding notice. A contract alone does not demonstrate service-provider oversight.
Source locator
17 CFR Part 248
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsSEC cybersecurity disclosure rules
Public-company registrants subject to the relevant Exchange Act reporting forms; domestic and foreign private issuer mechanisms differ.
Duties, evidence, limitations & official sources
Status / timing
In force for covered registrants
Duties / expectations
Requires specified material incident disclosures and periodic descriptions of cyber risk management, strategy and governance. The materiality determination and disclosure timetable are distinct from technical incident severity.
Evidence to consider
Documented materiality/escalation process, disclosure controls, board/management role evidence and consistency between filings and actual practice.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Regulation S-K Item 106; Form 8-K Item 1.05
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsInteragency model risk management guidance - SR26-2
Interagency guidance most relevant to supervised banking organizations with more than $30 billion in total assets; smaller organizations with significant model exposure should consider applicability. The guidance covers complex quantitative models, including non-generative, non-agentic AI models. Footnote 3 expressly excludes generative and agentic AI from its scope.
Duties, evidence, limitations & official sources
Status / timing
Issued April 17, 2026; supersedes SR11-7 and SR21-8
Duties / expectations
Recommends risk-based model development, use, validation and governance. It does not create enforceable legal requirements and must not be represented as a generative-AI or agentic-AI compliance framework. Separate governance, consumer-protection, privacy, safety-and-soundness and contractual duties may still apply to those uses.
Evidence to consider
Model inventory, materiality and limitations, independent challenge, validation, change control and risk acceptance.
Scope qualification
Keep the covered-model inventory distinct from the broader AI-system inventory. Exclusion from this guidance is not exemption from other law or sound risk management.
Source locator
SR26-2, April 17, 2026; applicability statement and revised guidance footnotes 1 and 3
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsInteragency third-party relationship risk management
Banking organizations supervised by the Federal Reserve, FDIC or OCC; lifecycle practices scaled to the risk of each relationship.
Duties, evidence, limitations & official sources
Status / timing
Final interagency guidance, 2023
Duties / expectations
Addresses planning, diligence, contracting, monitoring and termination. AI-model APIs, cloud platforms and data/agent suppliers should be evaluated as relationships, not just purchased software.
Evidence to consider
Risk tiering, diligence exceptions, enforceable audit/incident/exit terms, monitoring evidence and termination plans.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
SR23-4
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsEqual Credit Opportunity Act / Regulation B
Covered creditors making credit decisions, including AI-enabled underwriting. Technology choice does not eliminate statutory notification duties.
Duties, evidence, limitations & official sources
Status / timing
In force; current regulation controls
Duties / expectations
Prohibits specified discrimination and requires accurate principal reasons for adverse actions. Use the current regulation; agency circulars are interpretation, not the statute itself.
Evidence to consider
Credit decision provenance, reason-code validation, fair-lending testing and adverse-action notices.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
12 CFR 1002, especially 1002.9
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsFair Credit Reporting Act
Consumer reporting agencies, furnishers and users of consumer reports as defined; AI scoring vendors can create reporting-law obligations depending on their actual functions.
Duties, evidence, limitations & official sources
Status / timing
In force
Duties / expectations
Regulates permissible purpose, accuracy, disputes and relevant notices. Employment screening and eligibility scoring need classification before deployment.
Evidence to consider
Purpose controls, accuracy/dispute workflows, source lineage, notice records and vendor-role analysis.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
15 USC 1681 et seq.
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsBank Secrecy Act / AML program requirements
Covered financial institutions, including covered MSBs. AML program, customer due-diligence and reporting obligations differ by institution type.
Duties, evidence, limitations & official sources
Status / timing
In force; institution-specific rules apply
Duties / expectations
AI-assisted monitoring does not transfer accountability for required programs, suspicious activity reporting or recordkeeping. Protect confidentiality and validate alert/decision workflows.
Evidence to consider
AML governance, risk assessment, model/threshold validation, investigator records, independent testing and SAR handling controls.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
31 USC 5311 et seq.; 31 CFR Chapter X
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsUS economic sanctions / OFAC compliance
US persons and transactions subject to applicable sanctions jurisdiction; extraterritorial and secondary-sanctions issues are fact-specific.
Duties, evidence, limitations & official sources
Status / timing
In force; program-specific rules change frequently
Duties / expectations
AI-enabled onboarding, payment, supplier or export workflows must respect applicable prohibitions. A screening score is not a legal determination or a substitute for escalation.
Evidence to consider
Current list/program screening, false-positive review, licensing analysis, escalation and auditable transaction decisions.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Applicable sanctions program regulations
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsNAIC model bulletin on insurer use of AI
Insurers in states adopting the bulletin or related guidance. NAIC publication alone is not a nationwide enforceable statute.
Duties, evidence, limitations & official sources
Status / timing
Model bulletin; state adoption and variations control
Duties / expectations
Calls for a written AI-systems program, governance, risk controls, testing and documentation supporting compliance with insurance law. Third-party systems remain relevant to insurer accountability.
Evidence to consider
AI inventory, consumer-impact review, written program, validation, vendor evidence and state-by-state applicability matrix.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
AI Model Bulletin; individual state adoption
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsPCI DSS v4.0.1
Entities storing, processing or transmitting payment-card account data, and entities able to affect its security, as scoped by payment-brand/acquirer obligations.
Duties, evidence, limitations & official sources
Status / timing
Contractual standard; not a general statute
Duties / expectations
Requires scoped controls for account-data security, access, testing, monitoring and secure development. AI integrations can alter scope or create unauthorized storage.
Evidence to consider
Card-data flow maps, segmentation tests, access reviews, vulnerability management and assessment evidence.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
PCI DSS v4.0.1; future-dated requirements applied March 31, 2025
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsHIPAA Privacy and Breach Notification Rules
Covered entities and business associates handling protected health information. Not every wellness app or AI-generated health inference is HIPAA-covered.
Duties, evidence, limitations & official sources
Status / timing
In force; scope and exceptions are specific
Duties / expectations
Limits uses/disclosures and establishes individual rights and breach-notification duties. AI vendors require appropriate roles, contracts and permitted purposes.
Evidence to consider
BAAs, minimum-necessary analysis, access/amendment workflows, risk-of-compromise assessment and notice decisions.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
45 CFR Parts 160 and 164
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsHIPAA Security Rule
Covered entities and business associates safeguarding electronic PHI. Security-rule obligations are separate from general medical-device and consumer-app regulation.
Duties, evidence, limitations & official sources
Status / timing
Existing rule in force; do not treat the 2025 NPRM as final law
Duties / expectations
Requires administrative, physical and technical safeguards, risk analysis and risk management. Assess AI data stores, remote processing, model access and incident response.
Evidence to consider
ePHI inventory, risk analysis, access controls, audit records, contingency tests and vendor safeguards.
Scope qualification
The existing Security Rule remains the operative baseline in the reviewed HHS material. The January 2025 strengthening proposal is not labeled final here; verify any subsequent final rule and compliance date before presenting proposed controls as current law.
Source locator
45 CFR 164 Subpart C
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsCyber Incident Reporting for Critical Infrastructure Act
Entities and incidents ultimately covered by CISA's implementing regulations. Consult the live rulemaking record before assigning a compliance start date.
Duties, evidence, limitations & official sources
Status / timing
Implementing final rule under OIRA review; no operative final-rule reporting commencement verified
Duties / expectations
CIRCIA authorizes covered-entity cyber-incident and ransom-payment reporting. OIRA record RIN 1670-AA04 shows a final-rule submission received October 1, 2026 under pending review. A submission for review is not a published effective final rule. Do not present the statutory 72-hour/24-hour framework as a currently operative reporting duty for every critical-infrastructure organization.
Evidence to consider
Coverage watchlist, notification decision tree, preservation capabilities and reconciliation with other reporting regimes.
Scope qualification
Existing sector-specific, state, contractual and federal reporting duties continue independently. Check the Federal Register final text and effective/compliance dates before activating a CIRCIA reporting clock.
Source locator
CIRCIA; RIN 1670-AA04; OIRA review record 1550967
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsDelaware fiduciary oversight jurisprudence
Directors/officers and entities governed by relevant Delaware law. Applicable duties, exculpation and pleading standards require case-specific advice.
Duties, evidence, limitations & official sources
Status / timing
Fact-specific; not automatic liability after an incident
Duties / expectations
Good-faith oversight includes appropriate reporting systems and responses to significant warnings in context. An adverse AI outcome alone does not establish a fiduciary breach.
Evidence to consider
Board information flows, mission-critical risk escalation, documented challenge, resourcing and follow-through on identified deficiencies.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Caremark / Stone / Marchand line of authority
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
European Union Artificial Intelligence Act
Providers, deployers, importers, distributors and other covered actors; certain non-EU actors are included. System role, prohibited use, high-risk classification and GPAI status determine duties.
Duties, evidence, limitations & official sources
Status / timing
In force; current amended application dates and legacy-system transitions differ by provision
Duties / expectations
AI literacy and most prohibitions have applied since February 2, 2025; GPAI and specified governance provisions since August 2, 2025. Many transparency duties apply from August 2, 2026. Under the current consolidated Article 113 display, Annex III high-risk duties apply December 2, 2027 and Annex I product-related high-risk duties August 2, 2028. Article 111 gives pre-August 2, 2026 systems a December 2, 2026 transition for Article 50(2) marking/detection; new Article 5 prohibitions also have that later date.
Evidence to consider
Role/use-case classification, AI inventory, risk and data governance, oversight, logs, supplier documentation, testing and change/incident records.
Scope qualification
These are not one universal compliance date. Classify actor, use case, product regime, market-placement date, legacy status and subsequent changes. The Commission Service Desk displays the July 27, 2026 consolidated version; its summaries are explanatory, not a substitute for the legal text.
Source locator
Regulation (EU) 2024/1689 as amended
Review limitation
Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.
General Data Protection Regulation
Controllers/processors within Article 3 territorial scope; non-EU establishments can be covered by offering goods/services or monitoring people in the Union.
Duties, evidence, limitations & official sources
Status / timing
Applicable since May 25, 2018
Duties / expectations
Requires lawful, fair and transparent processing, minimization, security, rights and accountability. Assess DPIAs, Article 22 safeguards, special-category data and international transfers for relevant AI use.
Evidence to consider
ROPA, lawful-basis analysis, DPIA, processor terms, transfer assessments, rights handling, security testing and breach decisions.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Articles 5-6, 9, 12-22, 25, 28, 30, 32-35, 44-49
Review limitation
Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.
Explore related financial-services termsePrivacy Directive and national implementing laws
Electronic communications and related storage/access or direct-marketing activities under applicable member-state legislation.
Duties, evidence, limitations & official sources
Status / timing
National implementation controls
Duties / expectations
Addresses communications confidentiality, terminal-equipment storage/access and marketing rules. Consent exceptions and national implementations must be assessed rather than treating all analytics as automatically exempt.
Evidence to consider
Cookie/SDK inventory, consent and exemptions analysis, preference controls, marketing lists and vendor configurations.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Directive 2002/58/EC as amended
Review limitation
October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.
Explore related financial-services termsDigital Operational Resilience Act
Covered financial entities and designated critical ICT third-party providers, subject to the Act's proportionality/exemptions and implementing measures.
Duties, evidence, limitations & official sources
Status / timing
Applicable since January 17, 2025
Duties / expectations
Requires ICT risk governance, incident reporting, resilience testing and third-party controls. AI providers and cloud dependencies must be considered in the ICT service and concentration-risk model.
Evidence to consider
ICT register, management-body decisions, critical-function mapping, contract clauses, testing and incident classification/reporting records.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Regulation (EU) 2022/2554; Articles 5-16, 17-23, 24-30
Review limitation
October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.
Explore related financial-services termsUK GDPR / Data Protection Act 2018 / DUAA 2025
Controllers/processors within UK territorial scope. The UK regime is not identical to the EU GDPR after domestic amendments.
Duties, evidence, limitations & official sources
Status / timing
UK GDPR and DPA in force; all DUAA data-protection provisions in force by June 19, 2026
Duties / expectations
The DUAA amends rather than replaces UK GDPR, DPA 2018 and PECR. Significant automated decisions still require safeguards, with additional protection for special-category data. Organizations must facilitate data-protection complaints, acknowledge them within 30 days and respond without undue delay. UK lawful-basis, rights and transfer analysis must be distinct from EU GDPR analysis.
Evidence to consider
UK-specific lawful-basis/DPIA review, meaningful contest/review, notices, complaints and transfer documentation.
Scope qualification
Current status and changes checked against the ICO's June 19, 2026 update. The underlying UK legislation page was not assessed clause by clause; the ICO summary does not establish applicability to every overseas operator.
Source locator
UK GDPR as amended; DPA 2018; DUAA 2025
Review limitation
Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.
Explore related financial-services termsPrivacy and Electronic Communications Regulations
Electronic marketing and covered communications/terminal-equipment activities. Apply current exemptions and DUAA-related changes.
Duties, evidence, limitations & official sources
Status / timing
In force as amended
Duties / expectations
Governs marketing communications and storage/access technologies alongside UK data-protection law. A banner alone is not evidence that tracking respects consent.
Evidence to consider
Cookie/SDK audit, lawful-exemption register, consent records and suppression lists.
Scope qualification
DUAA amends PECR. Any storage/access exception is purpose- and safeguard-specific; it does not permit unrestricted tracking, profiling or advertising cookies without the otherwise required consent. Consult the current ICO storage/access guidance.
Source locator
SI 2003/2426 as amended
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsFCA operational resilience rules
FCA firms within SYSC 15A scope and corresponding prudential requirements where applicable.
Duties, evidence, limitations & official sources
Status / timing
In force; March 31, 2025 transition completed for covered firms
Duties / expectations
Requires identification of important business services, impact tolerances, mapping, scenario testing and remediation. AI and cloud concentration must be assessed at service level.
Evidence to consider
Important-service map, tolerance approvals, severe-but-plausible tests, third-party dependencies and self-assessment.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
FCA SYSC 15A; related PRA rules
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsFCA Consumer Duty
Firms and products/services within the FCA's retail-market scope, including relevant distribution-chain roles.
Duties, evidence, limitations & official sources
Status / timing
In force for covered retail business
Duties / expectations
Requires focus on good retail-customer outcomes, including understanding and support. AI-driven pricing, personalization or support should be tested against customer harm, not only efficiency.
Evidence to consider
Outcome monitoring, vulnerability analysis, product reviews, customer comprehension/support testing and governing-body oversight.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Principle 12; PRIN 2A
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsPIPEDA
Commercial personal-information processing within federal scope and cross-border activity; exemptions and provincial allocation require review.
Duties, evidence, limitations & official sources
Status / timing
In force; substantially similar provincial regimes may apply
Duties / expectations
Requires accountable, appropriate collection/use/disclosure, consent, safeguards, access/correction and qualifying breach reporting/records.
Evidence to consider
Purpose/consent records, privacy officer accountability, security, vendor controls and significant-harm assessment.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
S.C. 2000, c.5
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsQuebec private-sector privacy law (Law 25 reforms)
Enterprises holding personal information within Quebec private-sector law; separate public-sector statute applies to public bodies.
Duties, evidence, limitations & official sources
Status / timing
Reforms phased through 2024; current consolidated law controls
Duties / expectations
Requires privacy governance, impact assessments for specified systems/transfers, transparency for exclusively automated decisions and individual rights.
Evidence to consider
Privacy roles, PIA/transfer assessments, notices, decision-review mechanisms and retention/destruction evidence.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Act respecting the protection of personal information in the private sector
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsOSFI B-13 - technology and cyber risk
Federally regulated financial institutions and relevant foreign branches, applied proportionately to their Canadian operations.
Duties, evidence, limitations & official sources
Status / timing
Current supervisory guideline
Duties / expectations
Expects governance, technology operations/resilience and cyber-security management. Senior management must assign clear responsibilities and maintain risk-based controls.
Evidence to consider
Technology inventory, board reporting, secure development/change records, incident response, recovery and supplier controls.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Guideline B-13
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsAustralian Privacy Act and Australian Privacy Principles
APP entities including covered agencies/businesses; turnover and sector exceptions matter. Not every small business is exempt.
Duties, evidence, limitations & official sources
Status / timing
In force; new ADM privacy-policy duties commence December 10, 2026
Duties / expectations
Requires open/transparent management, purpose limits, quality, security and access/correction. New APP 1 automated-decision disclosures address significant decisions involving personal information.
Evidence to consider
APP scope, data maps, privacy policy, collection notices, ADM inventory, access/correction and breach response.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Privacy Act 1988; APPs; Notifiable Data Breaches scheme
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsAPRA CPS 234 - Information Security
APRA-regulated entities, with responsibilities for information assets managed by related parties and third parties.
Duties, evidence, limitations & official sources
Status / timing
Mandatory for covered APRA entities
Duties / expectations
Requires security capability, implementation/testing of controls and notification of qualifying incidents/control weaknesses. Governing-body accountability is explicit.
Evidence to consider
Information classification, control testing, board oversight, third-party assurance and notification decisions.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Prudential Standard CPS 234
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsAPRA CPS 230 - Operational Risk Management
Covered APRA-regulated entities; current standard and service-provider transition arrangements apply.
Duties, evidence, limitations & official sources
Status / timing
Current version in force July 1, 2026
Duties / expectations
Requires operational-risk controls, critical-operation tolerances, continuity and material-service-provider management. Boards approve key plans and oversee remediation.
Evidence to consider
Critical operations map, tolerance decisions, scenario tests, service-provider agreements and board reporting.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Prudential Standard CPS 230
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsSingapore Personal Data Protection Act
Organizations processing personal data within PDPA scope; public agencies have a different governance regime.
Duties, evidence, limitations & official sources
Status / timing
In force
Duties / expectations
Requires accountability, notice/consent or applicable exceptions, purpose limitation, security, retention limits, access/correction, transfer controls and qualifying breach notification.
Evidence to consider
DPO accountability, purpose/exception analysis, vendor terms, security/retention records and rights handling.
Scope qualification
Source-review boundary (September 17, 2026): Direct full text was not retrievable; the entry is orientation only. No assumption that a planned rule is operative.
Source locator
Personal Data Protection Act 2012
Review limitation
October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.
Explore related financial-services termsSingapore PDPC guidance on AI use of personal data
Organizations developing/deploying AI systems using personal data, including recommendations, decisions and generative uses where PDPA applies.
Duties, evidence, limitations & official sources
Status / timing
Guidance interprets existing PDPA duties; not a separate AI statute
Duties / expectations
Explains personal-data use across development and deployment, including purposes, consent/exceptions and information to individuals. Model architecture does not remove data-protection duties.
Evidence to consider
Data-purpose and lawful-use register, notices, safeguards, testing and vendor accountability.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
2024 AI advisory guidelines; check later PDPC supplements
Review limitation
October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.
Explore related financial-services termsMAS Technology Risk Management Guidelines
Financial institutions within MAS supervision, with institution-specific cyber hygiene and technology notices where applicable.
Duties, evidence, limitations & official sources
Status / timing
January 2021 Technology Risk Management Guidelines; current official publication page accessible
Duties / expectations
Sets governance, secure development, operations, resilience and cyber-risk expectations. AI outsourcing and model services should fit the technology-risk framework.
Evidence to consider
Technology governance, secure design/testing, critical-service mapping, outsourcing diligence and incident/recovery evidence.
Scope qualification
The official guidance page was accessible on October 13, 2026, resolving the earlier retrieval limitation. Separate the guidelines from binding notices applicable to a particular licensee and from incident-notification instructions.
Source locator
TRM Guidelines and relevant MAS notices
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsJapan Act on the Protection of Personal Information
Business operators and other entities within APPI scope; overseas handling and cross-border transfers have specific requirements.
Duties, evidence, limitations & official sources
Status / timing
In force as amended; Japanese original controls
Duties / expectations
Requires specified purposes, appropriate acquisition/security, rights handling and controls on third-party/cross-border provision. AI data processing needs purpose and transfer review.
Evidence to consider
Purpose notices, special-care information handling, third-party records, security, rights and breach decisions.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
APPI and PPC rules/guidelines
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsChina Personal Information Protection Law
Personal-information handlers within territorial/extraterritorial statutory scope. Localization and transfer obligations depend on thresholds and current implementing measures.
Duties, evidence, limitations & official sources
Status / timing
In force; official Chinese text controls
Duties / expectations
Requires lawful processing, notice/consent or other grounds, rights, security and relevant impact assessments. Automated decisions have transparency/fairness and contest-related protections.
Evidence to consider
Processing grounds, sensitive-data assessment, automated-decision review, transfer mechanism and rights evidence.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
PIPL, including Article 24
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsChina Data Security Law
Data activities within statutory scope, with important/core-data and national-security implications beyond personal information.
Duties, evidence, limitations & official sources
Status / timing
In force; classification/export rules require current local review
Duties / expectations
Requires classification-based data security and risk management, with additional duties for relevant important-data processing. Distinguish personal-information and industrial/security data requirements.
Evidence to consider
Data classification, risk assessments, access controls, incident handling and cross-border authorization analysis.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Data Security Law 2021
Review limitation
October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.
Explore related financial-services termsChina Interim Measures for Generative AI Services
Generative AI services provided to the public in China; the measures exclude certain nonpublic internal research/application uses from their specific scope.
Duties, evidence, limitations & official sources
Status / timing
Effective August 15, 2023
Duties / expectations
Addresses lawful training sources, personal information/IP, content obligations, service protection and oversight. Other cyber/data/sector laws still apply to excluded internal use.
Evidence to consider
Dataset provenance, consent/rights, content safeguards, complaint/incident handling and provider filing/security assessment where applicable.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
CAC and six other agencies, Order 15
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsIndia Digital Personal Data Protection Act and Rules
Digital personal-data processing within the Act's territorial/extraterritorial scope. Confirm which statutory/rule provisions have commenced before treating all duties as operative.
Duties, evidence, limitations & official sources
Status / timing
Rules notified November 2025; phased 18-month implementation
Duties / expectations
Provides notice/consent and specified legitimate uses, data-fiduciary safeguards, individual rights, breach handling and additional duties for designated significant data fiduciaries.
Evidence to consider
Data-purpose/consent records, security controls, child-data review, rights/grievance workflow and phased compliance plan.
Scope qualification
The official November 2025 government explanation describes an 18-month phased implementation. The MeitY page did not yield readable current text in this review; consult the Gazette commencement notifications for the exact provisions operative on the relevant date. Do not label every substantive duty already effective.
Source locator
DPDP Act 2023; Rules 2025; commencement notifications
Review limitation
Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.
Explore related financial-services termsIndia CERT-In cybersecurity directions
Covered service providers, intermediaries, data centers, bodies corporate and government organizations; additional duties apply to specified services.
Duties, evidence, limitations & official sources
Status / timing
2022 directions; applicable scope and exemptions matter
Duties / expectations
Requires specified incident reporting, log retention, time synchronization and other records. Map Indian legal duties to overseas cloud/AI service architectures.
Evidence to consider
Incident classification/escalation, log availability, time controls, contact designation and required subscriber records.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
IT Act Section 70B directions, April 28, 2022
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsBrazil General Personal Data Protection Law
Personal-data processing within LGPD nexus; different lawful bases and public/private-sector rules may apply.
Duties, evidence, limitations & official sources
Status / timing
In force; ANPD regulations supplement the law
Duties / expectations
Requires legal basis, transparency, data-subject rights, safeguards and accountability. Article 20 addresses review of solely automated decisions affecting interests.
Evidence to consider
Legal-basis register, rights/review workflow, security, transfer controls and impact reports where required.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Law 13.709/2018 as amended
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsSouth Africa Protection of Personal Information Act
Responsible parties and operators within POPIA scope; special personal information and child data have additional constraints.
Duties, evidence, limitations & official sources
Status / timing
In force
Duties / expectations
Sets processing conditions, security safeguards, rights, cross-border rules and restrictions on specified automated decisions.
Evidence to consider
Information-officer governance, purpose/ground records, operator contracts, safeguards, rights and compromise notifications.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Act 4 of 2013; Section 71 automated decisions
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsSwiss Federal Act on Data Protection
Private persons and federal bodies within FADP scope; cantonal public-sector regimes can differ.
Duties, evidence, limitations & official sources
Status / timing
Revised Act effective September 1, 2023
Duties / expectations
Requires proportionate transparent processing, security, rights and relevant DPIAs; covers specified automated decisions and international disclosures.
Evidence to consider
Processing inventory, notices, impact assessments, automated-decision review, transfers and breach escalation.
Scope qualification
Source-review boundary (September 17, 2026): Direct full text was not retrievable; the entry is orientation only. No assumption that a planned rule is operative.
Source locator
Federal Act on Data Protection of September 25, 2020
Review limitation
October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.
Explore related financial-services termsNew Zealand Privacy Act
Agencies and organizations within statutory scope, including relevant overseas agencies carrying on business in New Zealand.
Duties, evidence, limitations & official sources
Status / timing
Privacy Act 2020 in force; IPP3A indirect-collection notice commenced May 1, 2026
Duties / expectations
Privacy principles govern collection, notice, security, accuracy, rights, retention, use, disclosure and overseas transfers. New IPP3A extends notice obligations to covered indirect collection.
Evidence to consider
Privacy notices, indirect-data provenance, security, access/correction, serious-harm breach assessment and transfer controls.
Scope qualification
IPP3A adds an indirect-collection notification duty subject to its exceptions. Existing principles, including the conditions for collecting indirectly, remain relevant; notice is not a blanket permission to collect.
Source locator
Privacy Act 2020; Privacy Amendment Act 2025
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsNIST AI Risk Management Framework 1.0
Organizations designing, developing, deploying or using AI; voluntary unless incorporated into law, procurement or contract.
Duties, evidence, limitations & official sources
Status / timing
AI RMF 1.0 remains the published final framework; revision work is ongoing
Duties / expectations
Organizes work through Govern, Map, Measure and Manage; trustworthiness is contextual and involves trade-offs. It does not certify an AI system or replace jurisdiction-specific law.
Evidence to consider
AI inventory, risk governance, evaluations, response plans, ownership and documented residual risk.
Scope qualification
NIST states that AI RMF 1.0 is being revised. A revision project or critical-infrastructure concept note is not a final replacement framework or a certification program.
Source locator
AI RMF 1.0 / NIST AI 100-1
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsNIST Generative AI Profile
Organizations using generative models and applications; companion profile to the AI RMF.
Duties, evidence, limitations & official sources
Status / timing
NIST AI600-1 final, July 26, 2024; voluntary Generative AI Profile
Duties / expectations
Identifies generative-AI risks and potential actions, including content integrity, privacy, security, value-chain and information risks. Actions need context-specific selection.
Evidence to consider
Threat/use-case analysis, test plans, content provenance, supplier evidence and monitoring.
Scope qualification
The profile supplements AI RMF 1.0 and recommends risk-management actions. It is not a universal safety guarantee or an independent certification scheme.
Source locator
NIST AI 600-1
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsNIST Cybersecurity Framework
Organizations managing cyber risk, including business processes supported by AI.
Duties, evidence, limitations & official sources
Status / timing
Published guidance or standard; binding only where adopted
Duties / expectations
Provides Govern, Identify, Protect, Detect, Respond and Recover outcomes. Profiles and tiers guide communication; mapping a control is not proof that an outcome is achieved.
Evidence to consider
Current/target profiles, risk priorities, control evidence and improvement tracking.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
CSF 2.0
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsNIST Privacy Framework - final 1.0 / draft 1.1
Organizations managing privacy risk across data-processing ecosystems.
Duties, evidence, limitations & official sources
Status / timing
Version 1.0 final; version 1.1 Initial Public Draft remains draft in the reviewed publication record
Duties / expectations
Connects data-processing activities to privacy outcomes and governance. It is voluntary and distinct from a checklist for GDPR or US state-law compliance.
Evidence to consider
Data processing maps, privacy risk assessment, controls and communication.
Scope qualification
Use 1.0 as the final adoption baseline unless an organization explicitly adopts draft material. A closed comment period does not make version 1.1 final.
Source locator
Privacy Framework 1.0; NIST CSWP40 (1.1 Initial Public Draft)
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsNIST SP800-53 Rev.5 - security and privacy controls
Information systems within adopted security/privacy baselines; federal use and nonfederal contractual uses differ.
Duties, evidence, limitations & official sources
Status / timing
Revision 5 final; minor Release 5.2.0 issued August 27, 2025
Duties / expectations
Defines control families for access, audit, assessment, incident response and more. Tailoring, implementation and assessment are required; a crosswalk alone proves nothing.
Evidence to consider
Control applicability, implementation statements, assessments, POA&M and continuous monitoring.
Scope qualification
Select and tailor controls under the applicable authorization/risk process. A minor catalog release is not automatic amendment of every existing contract, authorization baseline or organizational control set.
Source locator
SP 800-53 Rev.5 with updates
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsNIST SSDF - SP800-218 v1.1 / v1.2 draft
Software producers and acquirers, including AI harnesses, toolchains and dependencies.
Duties, evidence, limitations & official sources
Status / timing
SSDF v1.1 final (2022); SP800-218 Rev. 1 / SSDF v1.2 Initial Public Draft (December 2025)
Duties / expectations
Recommends secure development practices and vulnerability response throughout the lifecycle. Contractual attestations and acquisition requirements are separate obligations.
Evidence to consider
Secure builds, code review, provenance, dependency controls, testing and vulnerability records.
Scope qualification
SP800-218A is a separate final AI-model development profile. Do not describe SSDF v1.2 draft practices as an adopted contractual requirement unless the relevant instrument expressly incorporates them.
Source locator
SP800-218 final; SP800-218 Rev.1 Initial Public Draft; SSDF publications list
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsNIST incident response recommendations
Organizations integrating cyber incident response into risk management.
Duties, evidence, limitations & official sources
Status / timing
SP800-61 Rev.3 final, April 2025; a CSF 2.0 Community Profile
Duties / expectations
Connects preparation, detection, response and recovery with CSF 2.0. Use for agentic containment and evidence plans, not as a substitute for mandatory notification rules.
Evidence to consider
Incident playbooks, exercise records, containment authorization, recovery verification and lessons learned.
Scope qualification
Revision 3 supersedes Revision 2. Adapt response activities to the organization; the publication is not itself a statutory incident-notification timetable.
Source locator
SP 800-61 Rev.3
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsNIST post-quantum cryptography standards
Cryptographic implementations and organizations with mandated or risk-based migration needs.
Duties, evidence, limitations & official sources
Status / timing
Published guidance or standard; binding only where adopted
Duties / expectations
Standardizes ML-KEM key encapsulation and ML-DSA/SLH-DSA signatures. Standards do not by themselves certify a whole product or mandate a single global migration date.
Evidence to consider
Cryptographic inventory, data-secrecy horizon, vendor readiness, interoperability and migration testing.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
FIPS 203, 204 and 205
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsISO/IEC 42001 AI management systems
Organizations adopting an AI management system, optionally subject to independent certification.
Duties, evidence, limitations & official sources
Status / timing
ISO/IEC 42001:2023; voluntary management-system standard unless incorporated
Duties / expectations
Specifies management-system requirements for responsible AI development/use and continual improvement. Certification scope does not establish universal AI Act or product compliance.
Evidence to consider
AI policy, roles, risks/impacts, objectives, operational controls, audits and corrective action.
Scope qualification
Publisher summary reviewed, not the licensed full standard. Certification concerns a defined management-system scope; it does not establish the safety or legal compliance of every model, product or use case.
Source locator
ISO/IEC 42001:2023
Review limitation
Source check covers publication identity and available summary, not a licensed clause-by-clause assessment.
Explore related financial-services termsISO/IEC 23894 AI risk management
Organizations managing risks associated with AI products, systems and services.
Duties, evidence, limitations & official sources
Status / timing
ISO/IEC 23894:2023 risk-management guidance
Duties / expectations
Provides risk-management guidance tailored to AI. It is not a standalone certifiable management-system requirement.
Evidence to consider
Risk criteria, assessments, treatments, monitoring and stakeholder communication.
Scope qualification
Publisher abstract reviewed; licensed full text not assessed. Guidance does not create a standalone AI product certification or substitute for applicable legal duties.
Source locator
ISO/IEC 23894:2023
Review limitation
Source check covers publication identity and available summary, not a licensed clause-by-clause assessment.
Explore related financial-services termsISO/IEC 27001 information security management
Organizations establishing an information security management system.
Duties, evidence, limitations & official sources
Status / timing
ISO/IEC 27001:2022 information-security management-system standard
Duties / expectations
Requires risk-based management, scoped controls and continual improvement. An ISMS certificate does not mean every AI use or vendor has been technically validated.
Evidence to consider
ISMS scope, risk treatment, statement of applicability, audits and corrective actions.
Scope qualification
Publisher summary reviewed; licensed normative text and applicable amendments require an authorized copy. A certificate must be checked for scope, issuing body and validity; it is not evidence that all controls always operate.
Source locator
ISO/IEC 27001:2022
Review limitation
Source check covers publication identity and available summary, not a licensed clause-by-clause assessment.
Explore related financial-services termsOWASP AI security guidance
Teams threat-modeling, testing and operating generative and agentic applications.
Duties, evidence, limitations & official sources
Status / timing
Published guidance or standard; binding only where adopted
Duties / expectations
Catalogs risks such as injection, supply-chain compromise, excessive agency and insecure output handling. It is community technical guidance, not legislation or certification.
Evidence to consider
Attack-surface map, adversarial tests, permission controls and detection/response evidence.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
LLM / agentic security projects
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsMITRE ATLAS
Security teams analyzing adversarial techniques against AI-enabled systems.
Duties, evidence, limitations & official sources
Status / timing
Published guidance or standard; binding only where adopted
Duties / expectations
Provides a knowledge base of adversary behavior and case studies. Mapping a technique supports threat analysis; it does not demonstrate control effectiveness.
Evidence to consider
Threat models, coverage analysis, exercises and observed detection/containment results.
Scope qualification
Source-review boundary (September 17, 2026): Living catalog; no exhaustive current technique count or identifier validation is claimed.
Source locator
Adversarial Threat Landscape for AI Systems
Review limitation
October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.
Explore related financial-services termsOECD AI Principles
Governments and organizations using the OECD policy framework and definitions.
Duties, evidence, limitations & official sources
Status / timing
Published guidance or standard; binding only where adopted
Duties / expectations
Promotes human-centered, transparent, robust and accountable AI. The recommendation is not directly enforceable as a private-sector statute.
Evidence to consider
Principles-to-control mapping, stakeholder review, transparency and accountability mechanisms.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
OECD Recommendation on Artificial Intelligence
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsWeb Content Accessibility Guidelines
Web content and applications; legal incorporation and required level vary by jurisdiction and contract.
Duties, evidence, limitations & official sources
Status / timing
Published guidance or standard; binding only where adopted
Duties / expectations
Provides testable accessibility criteria including keyboard access, focus, contrast and reflow. Automated testing alone is not a complete conformance assessment.
Evidence to consider
Accessibility tests, assistive-technology review, issue remediation and documented scope.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
WCAG 2.2
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsOWASP Top 10 for Agentic Applications 2026
Technical reference for behavioral conformance. Evaluate the sequence of plans, tool requests, retries, delegations and outcomes against an approved operating envelope. A plausible final answer is not evidence that the route taken was authorized.
Duties, evidence, limitations & official sources
Status / timing
Community risk taxonomy, published December 2025; not legislation
Duties / expectations
This entry describes technical guidance or specification context, not a standalone statutory duty. Define expected actions, prohibited means, materiality thresholds and escalation conditions for the use case before granting autonomy.
Evidence to consider
Task and session lineage; tool and policy decisions; versioned evaluation sets and results; quality/permission metrics; exception dispositions; comparisons between claimed completion and the actual system of record.
Scope qualification
Scope reconstructed from the saved v11 crosswalk. This review supports the published orientation summary, not complete legal applicability, implementation certification or every clause of the full instrument.
Source locator
OWASP Top 10 for Agentic Applications 2026
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsMCP authorization specification (2026-07-28)
Technical reference for action interlocks. Place enforceable checks between a proposed operation and its side effects. Tool availability, a model request and transport-level access must not be mistaken for business authorization.
Duties, evidence, limitations & official sources
Status / timing
Pinned specification edition; transport authorization is not business-action approval
Duties / expectations
For applicable HTTP-based MCP authorization, validate the token audience, use resource indicators and follow the specified discovery/issuer checks. Tokens must not be placed in query strings or passed through for another resource. Independently authorize the actual tool action, destination, scope and business effect; successful OAuth access is not approval for a payment, disclosure or destructive operation.
Evidence to consider
A tool/version inventory; argument-validation and authorization decisions; action-specific approval; execution receipt and reconciliation; exception or denial records; test evidence for bypass, replay and target substitution.
Scope qualification
Pinned July 28, 2026 reference. Transport authorization and business-action authorization are separate. The site is an educational diagram and does not implement or operate an MCP server.
Source locator
MCP authorization specification (2026-07-28)
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
OpenTelemetry GenAI span conventions
Technical reference for decision evidence. Create an independently protected record connecting the mandate, relevant inputs, versions, policy decisions, actions and observed outcomes. Make uncertainty and missing evidence explicit.
Duties, evidence, limitations & official sources
Status / timing
Technical conventions; many GenAI attributes/operations remain Development stability
Duties / expectations
Pin the semantic-convention revision used by each instrumentation pipeline and test schema changes. Capture trace context, model/version, operation, authorization and outcome metadata as appropriate. Prompt, response and tool-content capture requires a separately justified purpose, access control and retention decision; hashes are not necessarily anonymous.
Evidence to consider
A synchronized event chain; model/tool/policy version identifiers; downstream execution receipts; integrity and access records; collection-gap alerts; retention/hold decisions; disclosed reconstruction limitations.
Scope qualification
Do not assume that fields on a mutable main branch are stable or that OpenTelemetry automatically produces an OCSF mapping. Preserve the mapping/version and validate the evidence pipeline.
Source locator
OpenTelemetry GenAI span conventions
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsNIST SP 800-218A: AI-model secure development profile
Technical reference for lifecycle accountability. Keep use cases, dependencies, obligations, control owners and material changes under accountable governance from procurement through retirement. Repeatable evidence supports decisions; it does not transfer accountability.
Duties, evidence, limitations & official sources
Status / timing
Final, July 2024; complements SSDF, not a complete deployer compliance standard
Duties / expectations
This entry describes technical guidance or specification context, not a standalone statutory duty. Maintain a use-case register and SBOM/AIBOM scope covering relevant software, models, data, tools, connectors and hosting dependencies. Record known unknowns and validate provenance and critical components.
Evidence to consider
An accountable inventory; applicability analysis; component provenance and validation; release/change approvals; vendor obligations; exception and remediation decisions; board reporting and retirement evidence.
Scope qualification
Scope reconstructed from the saved v11 crosswalk. This review supports the published orientation summary, not complete legal applicability, implementation certification or every clause of the full instrument.
Source locator
NIST SP 800-218A: AI-model secure development profile
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsNCCoE: software and AI-agent identity and authorization
Technical reference for authority lineage. Keep the initiating person, each delegated agent and the executing service attributable. A handoff should narrow or preserve authorized scope, not silently create new authority.
Duties, evidence, limitations & official sources
Status / timing
NCCoE concept paper, February 2026; not a final practice guide or mandatory standard
Duties / expectations
This entry describes technical guidance or specification context, not a standalone statutory duty. Bind the principal, tenant, task purpose, permitted resources, duration and onward-delegation limits to each handoff.
Evidence to consider
An attributable delegation chain; policy version and decision identifier; requested versus granted scope; credential issuance and expiry; revoked-child and denied-action records. Protect identifiers and tokens: evidence should not become a secrets repository.
Scope qualification
The paper frames software/AI-agent identity and authorization work. Its presence in a crosswalk does not certify an implementation or create a new legal duty.
Source locator
NCCoE: software and AI-agent identity and authorization
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsCISA / international partners: SBOM for AI minimum elements
Technical reference for lifecycle accountability. Keep use cases, dependencies, obligations, control owners and material changes under accountable governance from procurement through retirement. Repeatable evidence supports decisions; it does not transfer accountability.
Duties, evidence, limitations & official sources
Status / timing
Recommendations, May 12, 2026; not a universal legal mandate; official indexed publication reviewed, full page access restricted
Duties / expectations
This entry describes technical guidance or specification context, not a standalone statutory duty. Maintain a use-case register and SBOM/AIBOM scope covering relevant software, models, data, tools, connectors and hosting dependencies. Record known unknowns and validate provenance and critical components.
Evidence to consider
An accountable inventory; applicability analysis; component provenance and validation; release/change approvals; vendor obligations; exception and remediation decisions; board reporting and retirement evidence.
Scope qualification
Scope reconstructed from the saved v11 crosswalk. Publication identity and described scope only. The full current document was not independently checked.
Source locator
CISA / international partners: SBOM for AI minimum elements
Review limitation
October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.
Explore related financial-services termsCISA: 2026 minimum elements for an SBOM
Technical reference for lifecycle accountability. Keep use cases, dependencies, obligations, control owners and material changes under accountable governance from procurement through retirement. Repeatable evidence supports decisions; it does not transfer accountability.
Duties, evidence, limitations & official sources
Status / timing
Guidance, July 29, 2026; complements, rather than substitutes for, component testing; official indexed publication reviewed, full page access restricted
Duties / expectations
This entry describes technical guidance or specification context, not a standalone statutory duty. Maintain a use-case register and SBOM/AIBOM scope covering relevant software, models, data, tools, connectors and hosting dependencies. Record known unknowns and validate provenance and critical components.
Evidence to consider
An accountable inventory; applicability analysis; component provenance and validation; release/change approvals; vendor obligations; exception and remediation decisions; board reporting and retirement evidence.
Scope qualification
Scope reconstructed from the saved v11 crosswalk. Publication identity and described scope only. The full current document was not independently checked.
Source locator
CISA: 2026 minimum elements for an SBOM
Review limitation
October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.
Explore related financial-services termsCalifornia SB813 - independent AI verification organizations
Establishes a framework for independent verification organizations assessing AI systems/models. Enactment is supported by the official signing announcement.
Duties, evidence, limitations & official sources
Status / timing
Signed September 9, 2026; detailed operative requirements require chaptered-text validation
Duties / expectations
Treat the announcement as an implementation development, not a claim that every AI deployer must immediately purchase an audit. Determine the final covered actors, recognition criteria and implementation dates from the chaptered text.
Evidence to consider
For planning: assessor-independence criteria, evaluation scope, conflict disclosures and procurement review.
Scope qualification
Official signing summary reviewed; chaptered full text and agency implementation not independently verified. No claim that Rich or this site is a state-recognized verifier.
Source locator
SB813 (2025-2026 session)
Review limitation
Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.
Explore related financial-services termsCalifornia AB1405 - AI auditor registry and independence
Creates an AI auditor registry and an independence/transparency framework, as described in the official signing announcement.
Duties, evidence, limitations & official sources
Status / timing
Signed September 9, 2026; registry implementation and operative details require validation
Duties / expectations
Do not infer a current registration status or universal enterprise audit obligation. Check the enacted scope, regulator implementation and auditor eligibility before relying on registry language.
Evidence to consider
For planning: qualifications, independence, conflicts, audit-method documentation and accurate representations about registration.
Scope qualification
Signing announcement supports this orientation; the registry's operational status and full statutory text were not independently verified.
Source locator
AB1405 (2025-2026 session)
Review limitation
Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.
Explore related financial-services termsCalifornia September 2026 AI oversight executive direction
Directs state work on independent oversight and recommendations for stronger frontier-AI safeguards.
Duties, evidence, limitations & official sources
Status / timing
September 18, 2026 executive direction; further proposals are not blanket private-sector mandates
Duties / expectations
The Governor calls for accelerated implementation work and recommendations on independent verification and emergency interruption. Recommendations under consideration are not treated as an already operative universal kill-switch requirement.
Evidence to consider
For planning: monitor agency implementation, interruption testing, independent evidence and clearly assigned response authority.
Scope qualification
Differentiate state-agency directions, enacted law, and potential future private-sector requirements.
Source locator
Executive direction announced September 18, 2026
Review limitation
Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.
Explore related financial-services termsCalifornia Delete Act / DROP data-broker deletion system
Registered data brokers within the Delete Act's scope; not every business maintaining an internal AI dataset is a data broker.
Duties, evidence, limitations & official sources
Status / timing
DROP regulations effective January 1, 2026; broker processing duties started August 1, 2026
Duties / expectations
Covered brokers must access/process DROP requests on the required cycle, generally at least every 45 days, and propagate applicable deletions. Validate exceptions, identity matching and downstream treatment under the final rules.
Evidence to consider
Broker status assessment, request-processing logs, matching/deletion decisions, downstream instructions and exception records.
Scope qualification
This is a broker-specific deletion mechanism, not a substitute for other CCPA rights workflows.
Source locator
Delete Act; DROP regulations
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsNIST AI RMF critical-infrastructure profile - concept stage
AI-enabled capabilities used by critical-infrastructure operators.
Duties, evidence, limitations & official sources
Status / timing
Concept note released April 7, 2026; not a final replacement for AI RMF 1.0
Duties / expectations
The NIST project identifies work toward sector-relevant AI risk-management practices. Use published final frameworks as the baseline; label concept material and proposed mappings explicitly.
Evidence to consider
For planning: use-case criticality, safety/continuity dependencies, risk ownership and documented feedback on draft practices.
Scope qualification
Project direction is not a standard, certification or legal obligation.
Source locator
AI RMF Profile for Trustworthy AI in Critical Infrastructure
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Explore related financial-services termsMake every boundary accountable.
Seven overlapping assurance domains connect delegated authority, trusted information, observable behavior, authorized actions, defensible evidence, containment and accountable change.