Principal duties or expectations

Article 50 transparency duties generally apply from August 2, 2026 (with a transition for qualifying pre-existing synthetic-content systems until December 2). New prohibited synthetic intimate-image/CSAM practices apply December 2, 2026. Annex III high-risk system obligations in Chapter III §§1–3 apply December 2, 2027; Annex I product high-risk obligations August 2, 2028. GPAI obligations already entered application in 2025.

Evidence to organize

AI-system/BOM inventory, role and Annex classifications, synthetic-content disclosures, prohibitions, GPAI documentation, notified-body/product dependencies, dated transition roadmap.

Source and scope

Regulation (EU) 2026/1744; amended AI Act Arts 50, 113

Text reviewed: 2026-10-27 | Source checked: 2026-10-27

Policy announcements, proposed rules and enacted laws have different legal force; applicability remains institution-specific.

Do not reuse pre-2026 high-risk dates. A delay of selected obligations does not suspend already-operative prohibitions or transparency duties.

Principal duties or expectations

Agencies instructed to use “Super Intelligence”/“SI” in place of AI in specified nonstatutory communications. EO orders a proposed legislative definition within 60 days. It does not enact a new comprehensive federal AI statute or replace the codified AI definition.

Evidence to organize

Public sector terminology mapping, source-authority crosswalk, unchanged statutory definitions and compliance traceability for existing instruments.

Source and scope

Executive Order 14434 (Sep. 29, 2026)

Text reviewed: 2026-10-27 | Source checked: 2026-10-27

Policy announcements, proposed rules and enacted laws have different legal force; applicability remains institution-specific.

Avoid representing terminological change as proof of technical superintelligence or new legal obligations for nonfederal entities.

Principal duties or expectations

FTC sought comment on potential deception from undisclosed suppression/distortion of outputs contrary to reasonable accuracy expectations. Proposal and legal preemption arguments should not be treated as finalized law or automatic state-law displacement.

Evidence to organize

AI claims register, documented intended outputs and testing, consumer-facing disclosures, misleading-performance escalation, change/version evidence.

Source and scope

FTC proposed policy statement, July 1, 2026

Text reviewed: 2026-10-27 | Source checked: 2026-10-27

Policy announcements, proposed rules and enacted laws have different legal force; applicability remains institution-specific.

Nonbinding proposal; independently evaluate enacted state consumer-protection and nondiscrimination duties.

Principal duties or expectations

Sets updated national AI development/utilization governance strategy. A Cabinet basic plan is not by itself a new license, penalty, or direct private-sector compliance deadline; APPI and other governing law remain separately applicable.

Evidence to organize

Japan market policy watch, product AI governance context, APPI mapping, supplier-contract monitoring.

Source and scope

Cabinet Decision, July 14, 2026

Text reviewed: 2026-10-27 | Source checked: 2026-10-27

Policy announcements, proposed rules and enacted laws have different legal force; applicability remains institution-specific.

Policy orientation; consult Japanese legal original and implementing ministry guidance for enforceable duties.

Principal duties or expectations

Government announced evaluation of powerful AI, AI-assisted vulnerability discovery, potential serious-agent incident/near-miss reporting and incident exercises. Proposed Bill-linked reporting remains subject to legislative process.

Evidence to organize

AI agent inventory, incident severity thresholds, vulnerability management evidence, OT/IT incident-playbook testing and regulatory-watch calendar.

Source and scope

UK Government October 12, 2026 statement

Text reviewed: 2026-10-27 | Source checked: 2026-10-27

Policy announcements, proposed rules and enacted laws have different legal force; applicability remains institution-specific.

Do not represent contemplated cyber incident reporting duties as already enacted.

Principal duties or expectations

Five pillars: energy independence, defense supply-chain resilience, strategic reserve, installation/cyber hardening, space-and-spectrum mission assurance. The plan responds to general disruptive threat classes; the government did not publicly attribute its adoption to a particular PRC/Iran operational alliance.

Evidence to organize

Energy islanding and OT resilience testing, asset/supply provenance, DIB dependency mapping, cyber recovery evidence, satellite/spectrum contingency exercises.

Source and scope

September 30 and October 6, 2026 program establishment

Text reviewed: 2026-10-27 | Source checked: 2026-10-27

Policy announcements, proposed rules and enacted laws have different legal force; applicability remains institution-specific.

Program is not a statute and currently provides no generally binding private-industry certification. Avoid inferring classified threat attribution from the announcement.

Principal duties or expectations

Includes conversational-AI disclosure, age estimation and appropriate safeguards for minors and self-harm response protocols. Rules are under state AG rulemaking; proposed implementing text is not final.

Evidence to organize

Consumer disclosures, minor-safety controls, crisis response playbooks, age-estimation impact assessments, vendor risk and retention logs.

Source and scope

Colorado HB26-1263 (2026)

Text reviewed: 2026-10-27 | Source checked: 2026-10-27

Policy announcements, proposed rules and enacted laws have different legal force; applicability remains institution-specific.

Consult signed bill and AG final rule, especially effective dates and exempt categories.

Principal duties or expectations

Prohibits unfair or deceptive acts or practices. AI performance, privacy, security and bias representations must match actual practices; using AI does not displace consumer-protection duties.

Evidence to organize

Maintain substantiation for public claims, tested security/privacy controls, complaint handling and documented corrective action. Evaluate actual consumer injury rather than relying on an AI label.

Source and scope

15 USC 45

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Includes notice, access, correction, deletion, sale/sharing opt-out and sensitive-information protections, subject to statutory scope and exceptions. Covered risk-assessment duties begin January 1, 2026, with assessment attestations and summaries due April 1, 2028. Covered ADMT requirements begin January 1, 2027. Initial cybersecurity-audit certifications are phased to April 1 of 2028, 2029 or 2030 according to the applicable revenue tier.

Evidence to organize

Data/use inventory; verified request workflow; opt-out signals; purpose/retention limits; vendor contracts; risk-assessment and audit applicability records.

Source and scope

California Civil Code 1798.100 et seq.

First determine whether each activity and audit/ADMT threshold is in scope. Revenue tiers determine the schedule only after audit applicability is established; exemptions are often data-specific rather than entity-wide.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires reasonable administrative, technical and physical safeguards and notifications for qualifying breaches. Outsourcing data handling does not eliminate safeguarding responsibilities.

Evidence to organize

Data classification, risk assessment, supplier diligence, safeguards testing, disposal schedules and incident notification decision records.

Source and scope

GBL 899-aa and 899-bb

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires notices, consumer rights, processor contracts and assessments for specified high-risk processing, including certain profiling. Sensitive-data consent and appeals requirements require operational workflows.

Evidence to organize

Processing inventory, rights/appeal case records, purpose limits, processor agreements and documented assessments.

Source and scope

Title 59.1, Chapter 53

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Regulates consumer rights, sensitive data, targeted advertising and high-risk processing. Covered controllers must honor applicable universal opt-out mechanisms and complete required data-protection assessments.

Evidence to organize

Data inventory, consent/opt-out evidence, profiling reviews, consumer appeals and vendor processing terms.

Source and scope

Colorado Revised Statutes 6-1-1301 et seq.

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

October 1 changes encompass state privacy obligations and new requirements touching facial-recognition notice, surveillance pricing, genetic data and data brokers. Do not characterize the package as a comprehensive AI model law or assume all provisions apply to each controller.

Evidence to organize

Connecticut coverage analysis, privacy notices, facial recognition signage/policy if applicable, consumer-rights handling, price-personalization review, vendor obligations and effective-date register.

Source and scope

Connecticut General Statutes 42-515 et seq.

Text reviewed: 2026-10-27 | Source checked: 2026-10-27

Dates, authority and cited provisions verified at instrument level; application to a specific institution requires jurisdiction and role analysis.

Connecticut Attorney General identified October 1, 2026 as the first effective wave; inspect separate statutory exceptions and later phases.

Principal duties or expectations

Requires consumer rights, notices, reasonable security, processor contracts and assessments for specified processing; sensitive-data sale restrictions can reach otherwise exempt small businesses.

Evidence to organize

Coverage memo, privacy notices, rights/appeal workflows, opt-out handling and high-risk processing assessments.

Source and scope

Business & Commerce Code Chapter 541

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires a consumer health privacy policy, consent for certain collection/sharing, separate authorization for sale, deletion rights and restrictions on health-facility geofencing.

Evidence to organize

Health-inference inventory, consent/authorization versions, processor controls, deletion across vendors and geofencing review.

Source and scope

RCW 19.373

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires informed written release for covered collection, a public retention/destruction policy, restrictions on disclosure/profit and protective handling. Private litigation exposure is distinct from general privacy laws.

Evidence to organize

Biometric purpose/retention policy, releases, vendor disclosures, destruction logs and security evidence.

Source and scope

740 ILCS 14

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Current primary-source retrieval restricted; inherited orientation retained October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.

Principal duties or expectations

Requires notices, verifiable parental consent where applicable, parental access/deletion, minimization, security and retention controls. Assess chatbots, voice/image collection and third-party advertising under the current rule.

Evidence to organize

Age-audience assessment, parental-consent records, SDK/vendor inventory, deletion capability and written retention/security practices.

Source and scope

16 CFR 312

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Protects education records; gives eligible students/parents access and amendment rights; limits disclosure. AI vendors cannot assume school data is freely available for their own model training.

Evidence to organize

School/vendor role allocation, permitted-purpose contracts, access controls, disclosure records and deletion/return terms.

Source and scope

20 USC 1232g; 34 CFR 99

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Prohibits specified discrimination. Assess disparate treatment and legally cognizable disparate impact under governing law; no vendor assurance substitutes for employer responsibility.

Evidence to organize

Job-related validation, selection-rate analysis, accommodation/escalation channels, vendor testing rights and decision records.

Source and scope

42 USC 2000e et seq.

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Prohibits disability discrimination and establishes applicable accommodation/access obligations. Test whether automated assessments screen out qualified people or inaccessible interfaces prevent participation.

Evidence to organize

Accessibility and accommodation procedures, validated selection criteria, alternative assessments and complaint resolution.

Source and scope

ADA Titles I, II and III as applicable

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires an independent bias audit within one year, public availability of required audit information and candidate/employee notices before covered use.

Evidence to organize

AEDT scope analysis, audit independence and methodology, published summary, notice evidence and periodic review.

Source and scope

Local Law 144 of 2021

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Prohibits specified harmful/manipulative and unlawful discriminatory uses; includes targeted disclosure and enforcement provisions. This is not a universal mandate that every AI user obtain certification.

Evidence to organize

Use-case screening, prohibited-use controls, disclosure review, documented intent/purpose and provider/deployer responsibility allocation.

Source and scope

HB 149, 89th Legislature

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Developer documentation of intended use, training-data categories, known limitations and human review; deployer notices and adverse-outcome explanations, access/correction and meaningful human reconsideration. Both parties must retain relevant records for at least three years. The prior SB24-205 law was repealed and reenacted, not simply delayed.

Evidence to organize

Covered-use inventory, developer deliverables, impact/decision flow, consumer notice, adverse-decision response workflow, human-review logs, three-year retention evidence, vendor obligations and rulemaking watch.

Source and scope

Colorado SB26-189 (2026), §§ 6-1-1701 et seq.

Text reviewed: 2026-10-27 | Source checked: 2026-10-27

Dates, authority and cited provisions verified at instrument level; application to a specific institution requires jurisdiction and role analysis.

As of October 27, 2026: October 26 rulemaking hearing/comment deadline occurred; published proposed rules should not be treated as final. Check AG docket for changes.

Principal duties or expectations

Requires covered safety frameworks, transparency disclosures, critical-safety-incident reporting and whistleblower protections. Disclosure duties differ by developer category.

Evidence to organize

Frontier-model threshold assessment, approved framework, evaluation records, release disclosures, incident reporting procedure and protected employee reporting.

Source and scope

Business & Professions Code 22757.10 et seq.; Labor Code 1107 and 1107.1

The Attorney General describes framework, incident and employee-reporting provisions. Separate the developer categories; this is not a general certification obligation for every enterprise using an AI tool.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Official summary or consolidated display reviewed; full legal applicability not certified Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.

Principal duties or expectations

SB1000 revises disclosure-verification, provenance, provider-licensee handling, and related definitions. The former user-count threshold and some earlier disclosure mechanics changed. Different provider/licensee obligations must be read in chaptered text; do not assume every AI deployer is a covered provider.

Evidence to organize

Actor/role coverage assessment; documented content provenance and verification controls; provider and licensee notification workflow; compliance change log for September 30 amendments.

Source and scope

CA B&P Code §§ 22757.1–22757.5; SB1000 (2026)

Text reviewed: 2026-10-27 | Source checked: 2026-10-27

Dates, authority and cited provisions verified at instrument level; application to a specific institution requires jurisdiction and role analysis.

September 30 urgency measure: immediate legal effect. Review the operative statute and the additional staged provisions separately; this is not a new generic California AI license requirement.

Principal duties or expectations

Creates transparency, safety-incident reporting, disclosure and related accountability obligations. Use the amended consolidated law rather than an earlier bill version.

Evidence to organize

Compute/revenue threshold analysis, safety framework, disclosure approvals, critical-incident escalation and preservation of evaluation evidence.

Source and scope

GBL 1420-1429

Article 44-B applies to defined large developers and covered frontier models, not every New York AI user. Confirm statutory thresholds, exemptions and implementing directions before treating an enterprise deployment as covered.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires a risk-based cybersecurity program, policies, CISO/governing-body oversight, controls, incident reporting and annual compliance submission. AI data flows and suppliers belong in the risk assessment.

Evidence to organize

Board reporting, asset inventory, risk assessment, control tests, MFA/PAM evidence, incident decisions, recovery tests and third-party reviews.

Source and scope

23 NYCRR Part 500

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires a written security program led by a qualified individual, risk assessment, safeguards, service-provider oversight and reporting. Specific notification duties have their own trigger.

Evidence to organize

Written program, governing-body reports, inventory, encryption/MFA rationale, testing, supplier monitoring and incident-notification record.

Source and scope

16 CFR 314

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires written incident-response policies, safeguards/disposal, service-provider oversight and compliance records. Covered notification is due as soon as practicable, generally no later than 30 days after awareness of the triggering unauthorized access/use, subject to the rule's investigation-based exception and authorized delay provisions. Do not equate every security alert with the notification trigger.

Evidence to organize

Incident-response program, affected-information analysis, notice decisions, service-provider records, retention and supervisory review.

Source and scope

17 CFR Part 248

Verify the affected information and covered individuals before deciding notice. A contract alone does not demonstrate service-provider oversight.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires specified material incident disclosures and periodic descriptions of cyber risk management, strategy and governance. The materiality determination and disclosure timetable are distinct from technical incident severity.

Evidence to organize

Documented materiality/escalation process, disclosure controls, board/management role evidence and consistency between filings and actual practice.

Source and scope

Regulation S-K Item 106; Form 8-K Item 1.05

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Risk-based model governance, development, implementation, validation, independent challenge and ongoing monitoring for covered quantitative and non-generative, non-agentic models. Footnote 3 expressly excludes generative and agentic AI from the scope of this guidance; other obligations and sound governance practices still apply.

Evidence to organize

Model inventory, materiality and limitations, independent challenge, validation, change control and risk acceptance.

Source and scope

SR26-2, April 17, 2026; applicability statement and revised guidance footnotes 1 and 3

Text reviewed: 2026-10-27 | Source checked: 2026-10-27

Dates, authority and cited provisions verified at instrument level; application to a specific institution requires jurisdiction and role analysis.

Most relevant to federally supervised banking organizations with assets exceeding $30 billion; not automatically binding on non-bank MSBs. Distinguish prudent analogy from actual supervisory applicability.

Principal duties or expectations

Addresses planning, diligence, contracting, monitoring and termination. AI-model APIs, cloud platforms and data/agent suppliers should be evaluated as relationships, not just purchased software.

Evidence to organize

Risk tiering, diligence exceptions, enforceable audit/incident/exit terms, monitoring evidence and termination plans.

Source and scope

SR23-4

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Prohibits specified discrimination and requires accurate principal reasons for adverse actions. Use the current regulation; agency circulars are interpretation, not the statute itself.

Evidence to organize

Credit decision provenance, reason-code validation, fair-lending testing and adverse-action notices.

Source and scope

12 CFR 1002, especially 1002.9

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Regulates permissible purpose, accuracy, disputes and relevant notices. Employment screening and eligibility scoring need classification before deployment.

Evidence to organize

Purpose controls, accuracy/dispute workflows, source lineage, notice records and vendor-role analysis.

Source and scope

15 USC 1681 et seq.

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

AI-assisted monitoring does not transfer accountability for required programs, suspicious activity reporting or recordkeeping. Protect confidentiality and validate alert/decision workflows.

Evidence to organize

AML governance, risk assessment, model/threshold validation, investigator records, independent testing and SAR handling controls.

Source and scope

31 USC 5311 et seq.; 31 CFR Chapter X

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

AI-enabled onboarding, payment, supplier or export workflows must respect applicable prohibitions. A screening score is not a legal determination or a substitute for escalation.

Evidence to organize

Current list/program screening, false-positive review, licensing analysis, escalation and auditable transaction decisions.

Source and scope

Applicable sanctions program regulations

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Calls for a written AI-systems program, governance, risk controls, testing and documentation supporting compliance with insurance law. Third-party systems remain relevant to insurer accountability.

Evidence to organize

AI inventory, consumer-impact review, written program, validation, vendor evidence and state-by-state applicability matrix.

Source and scope

AI Model Bulletin; individual state adoption

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires scoped controls for account-data security, access, testing, monitoring and secure development. AI integrations can alter scope or create unauthorized storage.

Evidence to organize

Card-data flow maps, segmentation tests, access reviews, vulnerability management and assessment evidence.

Source and scope

PCI DSS v4.0.1; future-dated requirements applied March 31, 2025

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Limits uses/disclosures and establishes individual rights and breach-notification duties. AI vendors require appropriate roles, contracts and permitted purposes.

Evidence to organize

BAAs, minimum-necessary analysis, access/amendment workflows, risk-of-compromise assessment and notice decisions.

Source and scope

45 CFR Parts 160 and 164

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires administrative, physical and technical safeguards, risk analysis and risk management. Assess AI data stores, remote processing, model access and incident response.

Evidence to organize

ePHI inventory, risk analysis, access controls, audit records, contingency tests and vendor safeguards.

Source and scope

45 CFR 164 Subpart C

The existing Security Rule remains the operative baseline in the reviewed HHS material. The January 2025 strengthening proposal is not labeled final here; verify any subsequent final rule and compliance date before presenting proposed controls as current law.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires qualifying breach notices to consumers, the FTC and sometimes media. Unauthorized disclosure can matter without a classic network intrusion.

Evidence to organize

Health-data/SDK map, authorization analysis, breach assessment, notifications and supplier escalation.

Source and scope

16 CFR Part 318

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires vulnerability-management plans, processes for reasonable cybersecurity assurance, update/patch arrangements and an SBOM. FDA guidance explains recommended evidence but is not itself the statute.

Evidence to organize

Threat model, SBOM, security design/testing, vulnerability disclosure and postmarket patch plans.

Source and scope

21 USC 360n-2; FDA final guidance June 2025

FD&C Act section 524B applies to covered cyber devices and submissions. FDA's June 27, 2025 final cybersecurity guidance supersedes the September 2023 version. Guidance recommendations and statutory submission duties are not interchangeable.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires suitable validation, access, audit trails, retention and signature controls for covered systems. AI-assisted changes must preserve the authenticity and integrity of regulated records.

Evidence to organize

System validation, access matrix, audit-trail review, change history and signature accountability.

Source and scope

21 CFR Part 11

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires an appropriate quality management system, risk-based processes and records. AI software changes require controlled design, validation and postmarket handling within the applicable quality system.

Evidence to organize

Design/change records, risk files, verification/validation, corrective actions and supplier controls.

Source and scope

21 CFR Part 820

Applies to covered device manufacturers and activities. AI use does not make every organization a medical-device manufacturer; determine device status, role and regulatory pathway first.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires reliable production, laboratory and quality-control records. AI-assisted release, analytics and deviation handling must remain within validated and authorized processes.

Evidence to organize

Validated intended use, data integrity, human review, audit trails, change controls and deviation/CAPA evidence.

Source and scope

21 CFR 211; related predicate requirements

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Address cyber-system categorization, security management, personnel/access, incident response, recovery and supply-chain risks across the applicable CIP standards.

Evidence to organize

Asset scoping, access controls, change evidence, recovery tests, incident records and supplier-risk plans.

Source and scope

Applicable CIP standards and implementation plans

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires risk/resilience assessments and emergency-response plans, including relevant electronic and computer-system risks. Emergency-plan certification follows assessment certification.

Evidence to organize

Assessment scope, cyber/physical dependencies, continuity and response plan, training and EPA certification records.

Source and scope

AWIA Section 2013 / SDWA Section 1433

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

CIRCIA authorizes covered-entity cyber-incident and ransom-payment reporting. OIRA record RIN 1670-AA04 shows a final-rule submission received October 1, 2026 under pending review. A submission for review is not a published effective final rule. Do not present the statutory 72-hour/24-hour framework as a currently operative reporting duty for every critical-infrastructure organization.

Evidence to organize

Coverage watchlist, notification decision tree, preservation capabilities and reconciliation with other reporting regimes.

Source and scope

CIRCIA; RIN 1670-AA04; OIRA review record 1550967

Existing sector-specific, state, contractual and federal reporting duties continue independently. Check the Federal Register final text and effective/compliance dates before activating a CIRCIA reporting clock.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires agency information-security programs, risk management, controls, continuous monitoring and reporting. Apply to the full AI service and its dependencies.

Evidence to organize

Authorization boundary, risk assessment, control implementation, assessment/POA&M, continuous monitoring and agency responsibility assignments.

Source and scope

44 USC 3551-3558

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Addresses AI leadership/governance, inventories and management of high-impact AI risks. Agencies must allocate responsible officials and implement applicable safeguards.

Evidence to organize

AI use-case inventory, designated authority, impact classification, testing, monitoring and agency compliance records.

Source and scope

M-25-21

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Calls for competitive acquisition, performance/risk evaluation, portability, interoperability and clear data/IP rights. Agency contracting and governance functions must coordinate.

Evidence to organize

Acquisition risk review, vendor comparison, data-rights/exit provisions, performance acceptance and supply-chain evidence.

Source and scope

M-25-22

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires applicable safeguarding, cyber-incident reporting, preservation and cooperation. Cloud/AI handling must meet contract conditions; public-model submission is not automatically authorized.

Evidence to organize

CUI boundary, flowdowns, applicable NIST controls, incident records, cloud approval and data-access limitations.

Source and scope

DFARS 252.204-7012

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

The official program notice suspends Phase II, formerly scheduled for November 10, 2026, while the program is reviewed. Existing Phase I self-assessment and applicable safeguarding, assessment and affirmation requirements remain. Review the actual solicitation, contract and current implementation instructions; the suspension does not repeal DFARS 252.204-7012.

Evidence to organize

Scoped assets, security plan, evidence of implemented practices, assessment findings and responsible-official affirmation.

Source and scope

32 CFR Part 170; applicable DFARS clauses; official CMMC program suspension notice

Do not state that every defense contractor must obtain a new third-party CMMC certification by November 10, 2026. Verify any subsequent program decision and the clauses in the particular contract.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Official summary or consolidated display reviewed; full legal applicability not certified Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.

Principal duties or expectations

Controls collection/use/disclosure of agency records and requires applicable privacy impact assessment and notice processes. AI use does not remove administrative-law and privacy obligations.

Evidence to organize

SORN/PIA applicability, authority/purpose statement, records schedules, access/amendment mechanisms and disclosure controls.

Source and scope

5 USC 552a; E-Government Act Section 208

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Applicable duties include technology competence, client confidentiality, candor, communication and supervision. AI output and vendor handling require professional judgment, not unreviewed reliance.

Evidence to organize

AI-use policy, source verification, client/confidentiality analysis, vendor review and supervised work-product controls.

Source and scope

Rules 1.1, 1.4, 1.6, 3.3, 5.1 and 5.3 as locally adopted

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Rules govern disclosure/discovery of electronic information and consequences when relevant ESI is lost. AI prompts, agent traces, decision logs and generated artifacts may become relevant ESI.

Evidence to organize

Legal holds, defensible collection, proportionality analysis, retention suspension and reproducible provenance.

Source and scope

Rules 26, 34 and 37(e); Rule 11 representations

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Good-faith oversight includes appropriate reporting systems and responses to significant warnings in context. An adverse AI outcome alone does not establish a fiduciary breach.

Evidence to organize

Board information flows, mission-critical risk escalation, documented challenge, resourcing and follow-through on identified deficiencies.

Source and scope

Caremark / Stone / Marchand line of authority

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

AI literacy and most prohibitions have applied since February 2, 2025; GPAI and specified governance provisions since August 2, 2025. Many transparency duties apply from August 2, 2026. Under the current consolidated Article 113 display, Annex III high-risk duties apply December 2, 2027 and Annex I product-related high-risk duties August 2, 2028. Article 111 gives pre-August 2, 2026 systems a December 2, 2026 transition for Article 50(2) marking/detection; new Article 5 prohibitions also have that later date.

Evidence to organize

Role/use-case classification, AI inventory, risk and data governance, oversight, logs, supplier documentation, testing and change/incident records.

Source and scope

Regulation (EU) 2024/1689 as amended

These are not one universal compliance date. Classify actor, use case, product regime, market-placement date, legacy status and subsequent changes. The Commission Service Desk displays the July 27, 2026 consolidated version; its summaries are explanatory, not a substitute for the legal text.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Official summary or consolidated display reviewed; full legal applicability not certified Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.

Principal duties or expectations

Requires lawful, fair and transparent processing, minimization, security, rights and accountability. Assess DPIAs, Article 22 safeguards, special-category data and international transfers for relevant AI use.

Evidence to organize

ROPA, lawful-basis analysis, DPIA, processor terms, transfer assessments, rights handling, security testing and breach decisions.

Source and scope

Articles 5-6, 9, 12-22, 25, 28, 30, 32-35, 44-49

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Official summary or consolidated display reviewed; full legal applicability not certified Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.

Principal duties or expectations

Addresses communications confidentiality, terminal-equipment storage/access and marketing rules. Consent exceptions and national implementations must be assessed rather than treating all analytics as automatically exempt.

Evidence to organize

Cookie/SDK inventory, consent and exemptions analysis, preference controls, marketing lists and vendor configurations.

Source and scope

Directive 2002/58/EC as amended

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Current primary-source retrieval restricted; inherited orientation retained October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.

Principal duties or expectations

Requires ICT risk governance, incident reporting, resilience testing and third-party controls. AI providers and cloud dependencies must be considered in the ICT service and concentration-risk model.

Evidence to organize

ICT register, management-body decisions, critical-function mapping, contract clauses, testing and incident classification/reporting records.

Source and scope

Regulation (EU) 2022/2554; Articles 5-16, 17-23, 24-30

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Current primary-source retrieval restricted; inherited orientation retained October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.

Principal duties or expectations

Requires risk-management measures, management accountability, supply-chain security and significant-incident reporting under implementing national laws.

Evidence to organize

Entity/national scope register, management training, supplier controls, technical safeguards, recovery tests and incident timelines.

Source and scope

Directive (EU) 2022/2555; Articles 20, 21 and 23

National implementing law and competent-authority decisions determine local coverage and enforcement. The Commission's January 20, 2026 targeted-amendment proposal is not treated here as enacted law. This library does not independently verify each Member State's transposition.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires cybersecurity throughout product lifecycle, vulnerability handling and conformity-related duties. Reporting provisions start earlier than most product requirements.

Evidence to organize

Product scope, security risk assessment, vulnerability handling, support-period decisions, component inventory and conformity documentation.

Source and scope

Regulation (EU) 2024/2847

Classify the product and manufacturer role, exclusions and commercial/open-source context. The reporting commencement is not postponed until the main 2027 product-compliance date. Commission practical guidance was published July 27, 2026.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Addresses notice/action, transparency, recommender systems and, for designated very large services, systemic-risk assessment and mitigation. It does not govern all enterprise AI as a platform.

Evidence to organize

Service classification, notice handling, recommender disclosures, risk/audit records and researcher-access governance where applicable.

Source and scope

Regulation (EU) 2022/2065

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Official summary or consolidated display reviewed; full legal applicability not certified Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.

Principal duties or expectations

Addresses access/use of product data, contractual fairness and cloud switching/interoperability. Personal-data access remains subject to privacy law and does not become a free training-data license.

Evidence to organize

Data-rights allocation, access interfaces, trade-secret safeguards, switching plans and supplier contract review.

Source and scope

Regulation (EU) 2023/2854

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Official summary or consolidated display reviewed; full legal applicability not certified Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.

Principal duties or expectations

Assess lawful access, rights reservations and national implementation before training or mining. Copyright, contract and privacy constraints are separate.

Evidence to organize

Corpus rights/provenance, reservation handling, licenses, access conditions and outputs/claims review.

Source and scope

Directive (EU) 2019/790; Articles 3-4

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Official summary or consolidated display reviewed; full legal applicability not certified Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.

Principal duties or expectations

Modernizes defective-product liability, relevant evidence disclosure and rebuttable presumptions under specified conditions. Distinguish compensation litigation from AI Act regulatory compliance.

Evidence to organize

Product/version lineage, safety decisions, update/support records, incident evidence and litigation preservation.

Source and scope

Directive (EU) 2024/2853

Do not apply the new directive indiscriminately to historic products or equate entry into force with national transposition. Check the relevant product-placement date, defendant role and national implementing law.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Official summary or consolidated display reviewed; full legal applicability not certified Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.

Principal duties or expectations

Requires risk/quality management, clinical evaluation, conformity assessment, technical documentation and postmarket/vigilance processes for covered devices.

Evidence to organize

Intended-use classification, clinical/performance evidence, technical file, software validation, cybersecurity and change control.

Source and scope

Regulation (EU) 2017/745

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Official summary or consolidated display reviewed; full legal applicability not certified Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.

Principal duties or expectations

Requires performance evaluation, quality/risk management, conformity documentation and surveillance/vigilance. AI diagnostic tools need intended-use and change analysis.

Evidence to organize

Analytical/clinical performance, data quality, validation, traceability, change decisions and postmarket evidence.

Source and scope

Regulation (EU) 2017/746

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Official summary or consolidated display reviewed; full legal applicability not certified Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.

Principal duties or expectations

Expects lifecycle risk management, validation, supplier oversight, security, data integrity, audit trails and continuity. Proposed revisions should be tracked separately from the published applicable version.

Evidence to organize

Validation plan, risk-based testing, audit-trail review, supplier evidence, periodic review and business continuity.

Source and scope

EudraLex Volume 4, Annex 11; related GMP chapters

Monitor Annex 11 revision and proposed AI-specific guidance separately. A consultation draft does not replace the published annex or remove applicable GMP validation, data-integrity and change-control duties.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Addresses essential health/safety and conformity requirements, including relevant software and protection against corruption. AI-enabled control does not remove physical-safety duties.

Evidence to organize

Safety risk assessment, control-system validation, software integrity, modification assessment and technical documentation.

Source and scope

Regulation (EU) 2023/1230

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires relevant all-hazards resilience assessment, protective measures, incident processes and oversight under national implementation.

Evidence to organize

Critical-service dependencies, all-hazards scenarios, physical/cyber coordination, continuity exercises and designation record.

Source and scope

Directive (EU) 2022/2557

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Official summary or consolidated display reviewed; full legal applicability not certified Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.

Principal duties or expectations

The DUAA amends rather than replaces UK GDPR, DPA 2018 and PECR. Significant automated decisions still require safeguards, with additional protection for special-category data. Organizations must facilitate data-protection complaints, acknowledge them within 30 days and respond without undue delay. UK lawful-basis, rights and transfer analysis must be distinct from EU GDPR analysis.

Evidence to organize

UK-specific lawful-basis/DPIA review, meaningful contest/review, notices, complaints and transfer documentation.

Source and scope

UK GDPR as amended; DPA 2018; DUAA 2025

Current status and changes checked against the ICO's June 19, 2026 update. The underlying UK legislation page was not assessed clause by clause; the ICO summary does not establish applicability to every overseas operator.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Official summary or consolidated display reviewed; full legal applicability not certified Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.

Principal duties or expectations

Governs marketing communications and storage/access technologies alongside UK data-protection law. A banner alone is not evidence that tracking respects consent.

Evidence to organize

Cookie/SDK audit, lawful-exemption register, consent records and suppression lists.

Source and scope

SI 2003/2426 as amended

DUAA amends PECR. Any storage/access exception is purpose- and safeguard-specific; it does not permit unrestricted tracking, profiling or advertising cookies without the otherwise required consent. Consult the current ICO storage/access guidance.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires identification of important business services, impact tolerances, mapping, scenario testing and remediation. AI and cloud concentration must be assessed at service level.

Evidence to organize

Important-service map, tolerance approvals, severe-but-plausible tests, third-party dependencies and self-assessment.

Source and scope

FCA SYSC 15A; related PRA rules

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires focus on good retail-customer outcomes, including understanding and support. AI-driven pricing, personalization or support should be tested against customer harm, not only efficiency.

Evidence to organize

Outcome monitoring, vulnerability analysis, product reviews, customer comprehension/support testing and governing-body oversight.

Source and scope

Principle 12; PRIN 2A

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Creates illegal-content, child-safety and related systems/process duties, with Ofcom codes and enforcement. Classify the actual service and audience.

Evidence to organize

Service/child-access assessment, risk assessments, reporting/complaint tools, safety controls and change review.

Source and scope

Online Safety Act 2023; current Ofcom codes

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Current primary-source retrieval restricted; inherited orientation retained October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.

Principal duties or expectations

Requires accountable, appropriate collection/use/disclosure, consent, safeguards, access/correction and qualifying breach reporting/records.

Evidence to organize

Purpose/consent records, privacy officer accountability, security, vendor controls and significant-harm assessment.

Source and scope

S.C. 2000, c.5

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires privacy governance, impact assessments for specified systems/transfers, transparency for exclusively automated decisions and individual rights.

Evidence to organize

Privacy roles, PIA/transfer assessments, notices, decision-review mechanisms and retention/destruction evidence.

Source and scope

Act respecting the protection of personal information in the private sector

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires algorithmic impact assessment and controls proportionate to impact, including transparency, testing, human involvement and recourse.

Evidence to organize

Published impact assessment where required, quality assurance, peer review, explanations and decision accountability.

Source and scope

Treasury Board directive and Algorithmic Impact Assessment

Source-review boundary (September 17, 2026): Direct full text was not retrievable; the entry is orientation only. No assumption that a planned rule is operative.

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Current primary-source retrieval restricted; inherited orientation retained October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.

Principal duties or expectations

Expects governance, technology operations/resilience and cyber-security management. Senior management must assign clear responsibilities and maintain risk-based controls.

Evidence to organize

Technology inventory, board reporting, secure development/change records, incident response, recovery and supplier controls.

Source and scope

Guideline B-13

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires open/transparent management, purpose limits, quality, security and access/correction. New APP 1 automated-decision disclosures address significant decisions involving personal information.

Evidence to organize

APP scope, data maps, privacy policy, collection notices, ADM inventory, access/correction and breach response.

Source and scope

Privacy Act 1988; APPs; Notifiable Data Breaches scheme

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires security capability, implementation/testing of controls and notification of qualifying incidents/control weaknesses. Governing-body accountability is explicit.

Evidence to organize

Information classification, control testing, board oversight, third-party assurance and notification decisions.

Source and scope

Prudential Standard CPS 234

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires operational-risk controls, critical-operation tolerances, continuity and material-service-provider management. Boards approve key plans and oversee remediation.

Evidence to organize

Critical operations map, tolerance decisions, scenario tests, service-provider agreements and board reporting.

Source and scope

Prudential Standard CPS 230

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires accountability, notice/consent or applicable exceptions, purpose limitation, security, retention limits, access/correction, transfer controls and qualifying breach notification.

Evidence to organize

DPO accountability, purpose/exception analysis, vendor terms, security/retention records and rights handling.

Source and scope

Personal Data Protection Act 2012

Source-review boundary (September 17, 2026): Direct full text was not retrievable; the entry is orientation only. No assumption that a planned rule is operative.

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Current primary-source retrieval restricted; inherited orientation retained October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.

Principal duties or expectations

Explains personal-data use across development and deployment, including purposes, consent/exceptions and information to individuals. Model architecture does not remove data-protection duties.

Evidence to organize

Data-purpose and lawful-use register, notices, safeguards, testing and vendor accountability.

Source and scope

2024 AI advisory guidelines; check later PDPC supplements

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Current primary-source retrieval restricted; inherited orientation retained October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.

Principal duties or expectations

Sets governance, secure development, operations, resilience and cyber-risk expectations. AI outsourcing and model services should fit the technology-risk framework.

Evidence to organize

Technology governance, secure design/testing, critical-service mapping, outsourcing diligence and incident/recovery evidence.

Source and scope

TRM Guidelines and relevant MAS notices

The official guidance page was accessible on October 13, 2026, resolving the earlier retrieval limitation. Separate the guidelines from binding notices applicable to a particular licensee and from incident-notification instructions.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires specified purposes, appropriate acquisition/security, rights handling and controls on third-party/cross-border provision. AI data processing needs purpose and transfer review.

Evidence to organize

Purpose notices, special-care information handling, third-party records, security, rights and breach decisions.

Source and scope

APPI and PPC rules/guidelines

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires lawful processing, notice/consent or other grounds, rights, security and relevant impact assessments. Automated decisions have transparency/fairness and contest-related protections.

Evidence to organize

Processing grounds, sensitive-data assessment, automated-decision review, transfer mechanism and rights evidence.

Source and scope

PIPL, including Article 24

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires classification-based data security and risk management, with additional duties for relevant important-data processing. Distinguish personal-information and industrial/security data requirements.

Evidence to organize

Data classification, risk assessments, access controls, incident handling and cross-border authorization analysis.

Source and scope

Data Security Law 2021

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Current primary-source retrieval restricted; inherited orientation retained October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.

Principal duties or expectations

Addresses lawful training sources, personal information/IP, content obligations, service protection and oversight. Other cyber/data/sector laws still apply to excluded internal use.

Evidence to organize

Dataset provenance, consent/rights, content safeguards, complaint/incident handling and provider filing/security assessment where applicable.

Source and scope

CAC and six other agencies, Order 15

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Provides notice/consent and specified legitimate uses, data-fiduciary safeguards, individual rights, breach handling and additional duties for designated significant data fiduciaries.

Evidence to organize

Data-purpose/consent records, security controls, child-data review, rights/grievance workflow and phased compliance plan.

Source and scope

DPDP Act 2023; Rules 2025; commencement notifications

The official November 2025 government explanation describes an 18-month phased implementation. The MeitY page did not yield readable current text in this review; consult the Gazette commencement notifications for the exact provisions operative on the relevant date. Do not label every substantive duty already effective.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Official summary or consolidated display reviewed; full legal applicability not certified Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.

Principal duties or expectations

Requires specified incident reporting, log retention, time synchronization and other records. Map Indian legal duties to overseas cloud/AI service architectures.

Evidence to organize

Incident classification/escalation, log availability, time controls, contact designation and required subscriber records.

Source and scope

IT Act Section 70B directions, April 28, 2022

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires legal basis, transparency, data-subject rights, safeguards and accountability. Article 20 addresses review of solely automated decisions affecting interests.

Evidence to organize

Legal-basis register, rights/review workflow, security, transfer controls and impact reports where required.

Source and scope

Law 13.709/2018 as amended

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Sets processing conditions, security safeguards, rights, cross-border rules and restrictions on specified automated decisions.

Evidence to organize

Information-officer governance, purpose/ground records, operator contracts, safeguards, rights and compromise notifications.

Source and scope

Act 4 of 2013; Section 71 automated decisions

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires proportionate transparent processing, security, rights and relevant DPIAs; covers specified automated decisions and international disclosures.

Evidence to organize

Processing inventory, notices, impact assessments, automated-decision review, transfers and breach escalation.

Source and scope

Federal Act on Data Protection of September 25, 2020

Source-review boundary (September 17, 2026): Direct full text was not retrievable; the entry is orientation only. No assumption that a planned rule is operative.

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Current primary-source retrieval restricted; inherited orientation retained October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.

Principal duties or expectations

Privacy principles govern collection, notice, security, accuracy, rights, retention, use, disclosure and overseas transfers. New IPP3A extends notice obligations to covered indirect collection.

Evidence to organize

Privacy notices, indirect-data provenance, security, access/correction, serious-harm breach assessment and transfer controls.

Source and scope

Privacy Act 2020; Privacy Amendment Act 2025

IPP3A adds an indirect-collection notification duty subject to its exceptions. Existing principles, including the conditions for collecting indirectly, remain relevant; notice is not a blanket permission to collect.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Organizes work through Govern, Map, Measure and Manage; trustworthiness is contextual and involves trade-offs. It does not certify an AI system or replace jurisdiction-specific law.

Evidence to organize

AI inventory, risk governance, evaluations, response plans, ownership and documented residual risk.

Source and scope

AI RMF 1.0 / NIST AI 100-1

NIST states that AI RMF 1.0 is being revised. A revision project or critical-infrastructure concept note is not a final replacement framework or a certification program.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Identifies generative-AI risks and potential actions, including content integrity, privacy, security, value-chain and information risks. Actions need context-specific selection.

Evidence to organize

Threat/use-case analysis, test plans, content provenance, supplier evidence and monitoring.

Source and scope

NIST AI 600-1

The profile supplements AI RMF 1.0 and recommends risk-management actions. It is not a universal safety guarantee or an independent certification scheme.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Provides Govern, Identify, Protect, Detect, Respond and Recover outcomes. Profiles and tiers guide communication; mapping a control is not proof that an outcome is achieved.

Evidence to organize

Current/target profiles, risk priorities, control evidence and improvement tracking.

Source and scope

CSF 2.0

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Connects data-processing activities to privacy outcomes and governance. It is voluntary and distinct from a checklist for GDPR or US state-law compliance.

Evidence to organize

Data processing maps, privacy risk assessment, controls and communication.

Source and scope

Privacy Framework 1.0; NIST CSWP40 (1.1 Initial Public Draft)

Use 1.0 as the final adoption baseline unless an organization explicitly adopts draft material. A closed comment period does not make version 1.1 final.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Defines control families for access, audit, assessment, incident response and more. Tailoring, implementation and assessment are required; a crosswalk alone proves nothing.

Evidence to organize

Control applicability, implementation statements, assessments, POA&M and continuous monitoring.

Source and scope

SP 800-53 Rev.5 with updates

Select and tailor controls under the applicable authorization/risk process. A minor catalog release is not automatic amendment of every existing contract, authorization baseline or organizational control set.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Recommends secure development practices and vulnerability response throughout the lifecycle. Contractual attestations and acquisition requirements are separate obligations.

Evidence to organize

Secure builds, code review, provenance, dependency controls, testing and vulnerability records.

Source and scope

SP800-218 final; SP800-218 Rev.1 Initial Public Draft; SSDF publications list

SP800-218A is a separate final AI-model development profile. Do not describe SSDF v1.2 draft practices as an adopted contractual requirement unless the relevant instrument expressly incorporates them.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Connects preparation, detection, response and recovery with CSF 2.0. Use for agentic containment and evidence plans, not as a substitute for mandatory notification rules.

Evidence to organize

Incident playbooks, exercise records, containment authorization, recovery verification and lessons learned.

Source and scope

SP 800-61 Rev.3

Revision 3 supersedes Revision 2. Adapt response activities to the organization; the publication is not itself a statutory incident-notification timetable.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Recommends risk-based OT protection accounting for safety, availability and performance constraints. Enterprise IT controls may need adaptation.

Evidence to organize

OT inventory, segmentation, remote access, safety coordination and tested recovery.

Source and scope

SP 800-82 Rev.3

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Standardizes ML-KEM key encapsulation and ML-DSA/SLH-DSA signatures. Standards do not by themselves certify a whole product or mandate a single global migration date.

Evidence to organize

Cryptographic inventory, data-secrecy horizon, vendor readiness, interoperability and migration testing.

Source and scope

FIPS 203, 204 and 205

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Specifies management-system requirements for responsible AI development/use and continual improvement. Certification scope does not establish universal AI Act or product compliance.

Evidence to organize

AI policy, roles, risks/impacts, objectives, operational controls, audits and corrective action.

Source and scope

ISO/IEC 42001:2023

Publisher summary reviewed, not the licensed full standard. Certification concerns a defined management-system scope; it does not establish the safety or legal compliance of every model, product or use case.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Publisher edition/abstract checked; licensed normative text not assessed Source check covers publication identity and available summary, not a licensed clause-by-clause assessment.

Principal duties or expectations

Provides risk-management guidance tailored to AI. It is not a standalone certifiable management-system requirement.

Evidence to organize

Risk criteria, assessments, treatments, monitoring and stakeholder communication.

Source and scope

ISO/IEC 23894:2023

Publisher abstract reviewed; licensed full text not assessed. Guidance does not create a standalone AI product certification or substitute for applicable legal duties.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Publisher edition/abstract checked; licensed normative text not assessed Source check covers publication identity and available summary, not a licensed clause-by-clause assessment.

Principal duties or expectations

Requires risk-based management, scoped controls and continual improvement. An ISMS certificate does not mean every AI use or vendor has been technically validated.

Evidence to organize

ISMS scope, risk treatment, statement of applicability, audits and corrective actions.

Source and scope

ISO/IEC 27001:2022

Publisher summary reviewed; licensed normative text and applicable amendments require an authorized copy. A certificate must be checked for scope, issuing body and validity; it is not evidence that all controls always operate.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Publisher edition/abstract checked; licensed normative text not assessed Source check covers publication identity and available summary, not a licensed clause-by-clause assessment.

Principal duties or expectations

Addresses lifecycle security, zones/conduits and system/component requirements. Contract adoption, certification and regulatory use are not interchangeable.

Evidence to organize

Role-specific security program, architecture zones, component requirements, testing and lifecycle support.

Source and scope

IEC 62443 series

Publisher abstract and edition checked; licensed normative text was not reviewed. Do not infer series-wide certification or system conformity from a component-level reference.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Publisher edition/abstract checked; licensed normative text not assessed Source check covers publication identity and available summary, not a licensed clause-by-clause assessment.

Principal duties or expectations

Catalogs risks such as injection, supply-chain compromise, excessive agency and insecure output handling. It is community technical guidance, not legislation or certification.

Evidence to organize

Attack-surface map, adversarial tests, permission controls and detection/response evidence.

Source and scope

LLM / agentic security projects

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Provides a knowledge base of adversary behavior and case studies. Mapping a technique supports threat analysis; it does not demonstrate control effectiveness.

Evidence to organize

Threat models, coverage analysis, exercises and observed detection/containment results.

Source and scope

Adversarial Threat Landscape for AI Systems

Source-review boundary (September 17, 2026): Living catalog; no exhaustive current technique count or identifier validation is claimed.

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Current primary-source retrieval restricted; inherited orientation retained October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.

Principal duties or expectations

Promotes human-centered, transparent, robust and accountable AI. The recommendation is not directly enforceable as a private-sector statute.

Evidence to organize

Principles-to-control mapping, stakeholder review, transparency and accountability mechanisms.

Source and scope

OECD Recommendation on Artificial Intelligence

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Provides testable accessibility criteria including keyboard access, focus, contrast and reflow. Automated testing alone is not a complete conformance assessment.

Evidence to organize

Accessibility tests, assistive-technology review, issue remediation and documented scope.

Source and scope

WCAG 2.2

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Creates a framework for primary and secondary electronic health-data use, access and governance. Research/AI reuse is subject to permits, purposes and safeguards, not unrestricted data access.

Evidence to organize

Role/data map, secondary-use authorization, secure processing, access logs and phased EHR interoperability plan.

Source and scope

Regulation (EU) 2025/327

Commission implementing acts are part of the transition. Do not describe EHDS as a current blanket authorization to reuse health data for AI; permitted purpose, authorization, safeguards and applicable GDPR requirements remain important.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Official summary or consolidated display reviewed; full legal applicability not certified Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.

Principal duties or expectations

Governs authorization, participant protection, safety reporting and trial records. Validate AI roles in recruitment, endpoints and safety signals.

Evidence to organize

Protocol/approval records, consent, data integrity, safety reporting and oversight of outsourced activities.

Source and scope

Regulation (EU) 536/2014

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Official summary or consolidated display reviewed; full legal applicability not certified Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.

Principal duties or expectations

Requires lawful/proportionate processing, accuracy, security and safeguards for automated decisions, subject to national implementing law.

Evidence to organize

Legal authority, purpose classification, data-quality controls, access logs, review safeguards and rights exceptions analysis.

Source and scope

Directive (EU) 2016/680

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Official summary or consolidated display reviewed; full legal applicability not certified Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.

Principal duties or expectations

Requires adequate documentation and authorized disposition. Prompts, outputs and decision evidence may be records; a chatbot retention default is not an approved records schedule.

Evidence to organize

Records classification, approved schedules, capture/export, legal holds and auditable disposition.

Source and scope

44 USC Chapters 21, 29, 31 and 33; NARA regulations

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Requires competence, integrity, client-interest protection, confidentiality and effective supervision. Verify legal outputs and protect client information in AI workflows.

Evidence to organize

Vendor review, confidentiality controls, source checking, supervised outputs and complaint handling.

Source and scope

SRA Principles and Codes of Conduct

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

This entry describes technical guidance or specification context, not a standalone statutory duty. Define expected actions, prohibited means, materiality thresholds and escalation conditions for the use case before granting autonomy.

Evidence to organize

Task and session lineage; tool and policy decisions; versioned evaluation sets and results; quality/permission metrics; exception dispositions; comparisons between claimed completion and the actual system of record.

Source and scope

OWASP Top 10 for Agentic Applications 2026

Scope reconstructed from the saved v11 crosswalk. This review supports the published orientation summary, not complete legal applicability, implementation certification or every clause of the full instrument.

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

For applicable HTTP-based MCP authorization, validate the token audience, use resource indicators and follow the specified discovery/issuer checks. Tokens must not be placed in query strings or passed through for another resource. Independently authorize the actual tool action, destination, scope and business effect; successful OAuth access is not approval for a payment, disclosure or destructive operation.

Evidence to organize

A tool/version inventory; argument-validation and authorization decisions; action-specific approval; execution receipt and reconciliation; exception or denial records; test evidence for bypass, replay and target substitution.

Source and scope

MCP authorization specification (2026-07-28)

Pinned July 28, 2026 reference. Transport authorization and business-action authorization are separate. The site is an educational diagram and does not implement or operate an MCP server.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

Pin the semantic-convention revision used by each instrumentation pipeline and test schema changes. Capture trace context, model/version, operation, authorization and outcome metadata as appropriate. Prompt, response and tool-content capture requires a separately justified purpose, access control and retention decision; hashes are not necessarily anonymous.

Evidence to organize

A synchronized event chain; model/tool/policy version identifiers; downstream execution receipts; integrity and access records; collection-gap alerts; retention/hold decisions; disclosed reconstruction limitations.

Source and scope

OpenTelemetry GenAI span conventions

Do not assume that fields on a mutable main branch are stable or that OpenTelemetry automatically produces an OCSF mapping. Preserve the mapping/version and validate the evidence pipeline.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

This entry describes technical guidance or specification context, not a standalone statutory duty. Maintain a use-case register and SBOM/AIBOM scope covering relevant software, models, data, tools, connectors and hosting dependencies. Record known unknowns and validate provenance and critical components.

Evidence to organize

An accountable inventory; applicability analysis; component provenance and validation; release/change approvals; vendor obligations; exception and remediation decisions; board reporting and retirement evidence.

Source and scope

NIST SP 800-218A: AI-model secure development profile

Scope reconstructed from the saved v11 crosswalk. This review supports the published orientation summary, not complete legal applicability, implementation certification or every clause of the full instrument.

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

This entry describes technical guidance or specification context, not a standalone statutory duty. Bind the principal, tenant, task purpose, permitted resources, duration and onward-delegation limits to each handoff.

Evidence to organize

An attributable delegation chain; policy version and decision identifier; requested versus granted scope; credential issuance and expiry; revoked-child and denied-action records. Protect identifiers and tokens: evidence should not become a secrets repository.

Source and scope

NCCoE: software and AI-agent identity and authorization

The paper frames software/AI-agent identity and authorization work. Its presence in a crosswalk does not certify an implementation or create a new legal duty.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

This entry describes technical guidance or specification context, not a standalone statutory duty. Maintain a use-case register and SBOM/AIBOM scope covering relevant software, models, data, tools, connectors and hosting dependencies. Record known unknowns and validate provenance and critical components.

Evidence to organize

An accountable inventory; applicability analysis; component provenance and validation; release/change approvals; vendor obligations; exception and remediation decisions; board reporting and retirement evidence.

Source and scope

CISA / international partners: SBOM for AI minimum elements

Scope reconstructed from the saved v11 crosswalk. Publication identity and described scope only. The full current document was not independently checked.

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Current primary-source retrieval restricted; inherited orientation retained October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.

Principal duties or expectations

This entry describes technical guidance or specification context, not a standalone statutory duty. Maintain a use-case register and SBOM/AIBOM scope covering relevant software, models, data, tools, connectors and hosting dependencies. Record known unknowns and validate provenance and critical components.

Evidence to organize

An accountable inventory; applicability analysis; component provenance and validation; release/change approvals; vendor obligations; exception and remediation decisions; board reporting and retirement evidence.

Source and scope

CISA: 2026 minimum elements for an SBOM

Scope reconstructed from the saved v11 crosswalk. Publication identity and described scope only. The full current document was not independently checked.

Text reviewed: 2026-09-17 | Source checked: 2026-10-13

Current primary-source retrieval restricted; inherited orientation retained October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.

Principal duties or expectations

Treat the announcement as an implementation development, not a claim that every AI deployer must immediately purchase an audit. Determine the final covered actors, recognition criteria and implementation dates from the chaptered text.

Evidence to organize

For planning: assessor-independence criteria, evaluation scope, conflict disclosures and procurement review.

Source and scope

SB813 (2025-2026 session)

Official signing summary reviewed; chaptered full text and agency implementation not independently verified. No claim that Rich or this site is a state-recognized verifier.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Official summary or consolidated display reviewed; full legal applicability not certified Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.

Principal duties or expectations

Do not infer a current registration status or universal enterprise audit obligation. Check the enacted scope, regulator implementation and auditor eligibility before relying on registry language.

Evidence to organize

For planning: qualifications, independence, conflicts, audit-method documentation and accurate representations about registration.

Source and scope

AB1405 (2025-2026 session)

Signing announcement supports this orientation; the registry's operational status and full statutory text were not independently verified.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Official summary or consolidated display reviewed; full legal applicability not certified Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.

Principal duties or expectations

The Governor calls for accelerated implementation work and recommendations on independent verification and emergency interruption. Recommendations under consideration are not treated as an already operative universal kill-switch requirement.

Evidence to organize

For planning: monitor agency implementation, interruption testing, independent evidence and clearly assigned response authority.

Source and scope

Executive direction announced September 18, 2026

Differentiate state-agency directions, enacted law, and potential future private-sector requirements.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Official summary or consolidated display reviewed; full legal applicability not certified Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.

Principal duties or expectations

Covered brokers must access/process DROP requests on the required cycle, generally at least every 45 days, and propagate applicable deletions. Validate exceptions, identity matching and downstream treatment under the final rules.

Evidence to organize

Broker status assessment, request-processing logs, matching/deletion decisions, downstream instructions and exception records.

Source and scope

Delete Act; DROP regulations

This is a broker-specific deletion mechanism, not a substitute for other CCPA rights workflows.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.

Principal duties or expectations

The NIST project identifies work toward sector-relevant AI risk-management practices. Use published final frameworks as the baseline; label concept material and proposed mappings explicitly.

Evidence to organize

For planning: use-case criticality, safety/continuity dependencies, risk ownership and documented feedback on draft practices.

Source and scope

AI RMF Profile for Trustworthy AI in Critical Infrastructure

Project direction is not a standard, certification or legal obligation.

Text reviewed: 2026-10-13 | Source checked: 2026-10-13

Available official publication or source text reviewed at orientation level Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.