I connect AI, cyber and privacy obligations to the financial activity, accountable decision and evidence that matter. This public edition covers Financial services & insurance, including relevant international and cross-sector research.
More below: choose filters, then scroll to the matching references.
86 public financial-services records. JavaScript adds filtering; the readable public subset follows.
United States - federal / Law
FTC Act, Section 5
Businesses within Federal Trade Commission jurisdiction. Sectoral exemptions and the distinction between commercial conduct and regulated banking or nonprofit activity matter.
Duties, evidence, limitations & official sources
Status / timing
In force; case-specific enforcement
Duties / expectations
Prohibits unfair or deceptive acts or practices. AI performance, privacy, security and bias representations must match actual practices; using AI does not displace consumer-protection duties.
Evidence to consider
Maintain substantiation for public claims, tested security/privacy controls, complaint handling and documented corrective action. Evaluate actual consumer injury rather than relying on an AI label.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
15 USC 45
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsUnited States - California / Law
California Consumer Privacy Act / CPRA
For-profit businesses meeting statutory California thresholds; service-provider and contractor duties differ. Exemptions are often data-specific, not blanket exemptions for an entire enterprise.
Duties, evidence, limitations & official sources
Status / timing
CCPA/CPRA in force; 2025 final regulations effective January 1, 2026 with later compliance/submission dates
Duties / expectations
Includes notice, access, correction, deletion, sale/sharing opt-out and sensitive-information protections, subject to statutory scope and exceptions. Covered risk-assessment duties begin January 1, 2026, with assessment attestations and summaries due April 1, 2028. Covered ADMT requirements begin January 1, 2027. Initial cybersecurity-audit certifications are phased to April 1 of 2028, 2029 or 2030 according to the applicable revenue tier.
Evidence to consider
Data/use inventory; verified request workflow; opt-out signals; purpose/retention limits; vendor contracts; risk-assessment and audit applicability records.
Scope qualification
First determine whether each activity and audit/ADMT threshold is in scope. Revenue tiers determine the schedule only after audit applicability is established; exemptions are often data-specific rather than entity-wide.
Source locator
California Civil Code 1798.100 et seq.
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services termsUnited States - New York / Law
New York SHIELD Act and breach notification
Persons and businesses holding covered private information of New York residents; reasonable-security duties and notification triggers should be assessed separately.
Duties, evidence, limitations & official sources
Status / timing
In force
Duties / expectations
Requires reasonable administrative, technical and physical safeguards and notifications for qualifying breaches. Outsourcing data handling does not eliminate safeguarding responsibilities.
Evidence to consider
Data classification, risk assessment, supplier diligence, safeguards testing, disposal schedules and incident notification decision records.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
GBL 899-aa and 899-bb
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsUnited States - Virginia / Law
Virginia Consumer Data Protection Act
Controllers meeting Virginia resident-data or revenue thresholds, subject to statutory entity and data exemptions.
Duties, evidence, limitations & official sources
Status / timing
In force
Duties / expectations
Requires notices, consumer rights, processor contracts and assessments for specified high-risk processing, including certain profiling. Sensitive-data consent and appeals requirements require operational workflows.
Evidence to consider
Processing inventory, rights/appeal case records, purpose limits, processor agreements and documented assessments.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Title 59.1, Chapter 53
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsUnited States - Colorado / Law
Colorado Privacy Act
Controllers meeting statutory coverage tests with Colorado nexus; not every small business or employment record falls in scope.
Duties, evidence, limitations & official sources
Status / timing
In force; distinct from Colorado AI legislation
Duties / expectations
Regulates consumer rights, sensitive data, targeted advertising and high-risk processing. Covered controllers must honor applicable universal opt-out mechanisms and complete required data-protection assessments.
Evidence to consider
Data inventory, consent/opt-out evidence, profiling reviews, consumer appeals and vendor processing terms.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Colorado Revised Statutes 6-1-1301 et seq.
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsUnited States - Connecticut / Law
Connecticut Data Privacy Act
Covered controllers processing Connecticut resident data; thresholds, exemptions and child/teen protections must be evaluated under the current text.
Duties, evidence, limitations & official sources
Status / timing
In force; consult amended coverage and youth provisions
Duties / expectations
Creates consumer rights, consent and security duties, processor obligations and assessments for designated risky processing. Opt-out mechanisms and sensitive-data handling are important to AI personalization.
Evidence to consider
Rights and consent records, assessments, data-purpose controls, deletion propagation and supplier evidence.
Scope qualification
July 1, 2026 amendments broaden coverage to specified controllers processing at least 35,000 consumers, selling personal data or processing sensitive data, subject to exclusions. Review the amended youth, neural-data and other sensitive-data provisions rather than an older threshold summary.
Source locator
Connecticut General Statutes 42-515 et seq.
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsUnited States - Texas / Law
Texas Data Privacy and Security Act
Persons conducting business in Texas or producing products/services consumed by residents, subject to small-business and other statutory exclusions and exceptions.
Duties, evidence, limitations & official sources
Status / timing
In force; separate from Texas AI law
Duties / expectations
Requires consumer rights, notices, reasonable security, processor contracts and assessments for specified processing; sensitive-data sale restrictions can reach otherwise exempt small businesses.
Evidence to consider
Coverage memo, privacy notices, rights/appeal workflows, opt-out handling and high-risk processing assessments.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Business & Commerce Code Chapter 541
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsUnited States - Illinois / Law
Illinois Biometric Information Privacy Act
Private entities collecting or holding covered biometric identifiers/information, with statutory exclusions. Face recognition and voiceprint applications need classification beyond ordinary photos/audio.
Duties, evidence, limitations & official sources
Status / timing
In force; amended liability provisions require current-text review
Duties / expectations
Requires informed written release for covered collection, a public retention/destruction policy, restrictions on disclosure/profit and protective handling. Private litigation exposure is distinct from general privacy laws.
Evidence to consider
Biometric purpose/retention policy, releases, vendor disclosures, destruction logs and security evidence.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
740 ILCS 14
Review limitation
October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsUnited States - federal / Law
Title VII and employment discrimination
Covered employers, employment agencies and labor organizations. AI recruitment, assessment, promotion and termination tools remain employment-selection practices.
Duties, evidence, limitations & official sources
Status / timing
In force
Duties / expectations
Prohibits specified discrimination. Assess disparate treatment and legally cognizable disparate impact under governing law; no vendor assurance substitutes for employer responsibility.
Evidence to consider
Job-related validation, selection-rate analysis, accommodation/escalation channels, vendor testing rights and decision records.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
42 USC 2000e et seq.
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsUnited States - federal / Law
Americans with Disabilities Act
Covered employers, public entities and public accommodations under the relevant ADA title. Disability-sensitive algorithmic screening and digital accessibility need separate assessments.
Duties, evidence, limitations & official sources
Status / timing
In force
Duties / expectations
Prohibits disability discrimination and establishes applicable accommodation/access obligations. Test whether automated assessments screen out qualified people or inaccessible interfaces prevent participation.
Evidence to consider
Accessibility and accommodation procedures, validated selection criteria, alternative assessments and complaint resolution.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
ADA Titles I, II and III as applicable
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsUnited States - New York City / Law / regulation
New York City Local Law 144 - automated employment decisions
Employers and employment agencies using an AEDT within the law and rules' definition and geographic scope; not every workplace AI tool qualifies.
Duties, evidence, limitations & official sources
Status / timing
Enforced since July 5, 2023
Duties / expectations
Requires an independent bias audit within one year, public availability of required audit information and candidate/employee notices before covered use.
Evidence to consider
AEDT scope analysis, audit independence and methodology, published summary, notice evidence and periodic review.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Local Law 144 of 2021
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsUnited States - Texas / Law
Texas Responsible Artificial Intelligence Governance Act
Entities and AI systems within Texas jurisdiction as defined; government, healthcare and other provisions have differing scopes. Do not confuse this with TDPSA.
Duties, evidence, limitations & official sources
Status / timing
Effective January 1, 2026
Duties / expectations
Prohibits specified harmful/manipulative and unlawful discriminatory uses; includes targeted disclosure and enforcement provisions. This is not a universal mandate that every AI user obtain certification.
Evidence to consider
Use-case screening, prohibited-use controls, disclosure review, documented intent/purpose and provider/deployer responsibility allocation.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
HB 149, 89th Legislature
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsUnited States - Colorado / Law
Colorado automated decisionmaking law - SB26-189
Developers and deployers of covered automated decisionmaking technology used for consequential decisions, subject to defined exclusions and exceptions.
Duties, evidence, limitations & official sources
Status / timing
Enacted; operative January 1, 2027; replaces SB24-205 framework
Duties / expectations
Requires relevant technical documentation, notices and consumer review/reconsideration procedures; distinguishes developer and deployer duties. Preserve required decision records and evaluate the amended scope rather than relying on old SB24-205 summaries.
Evidence to consider
Coverage register, technical documentation, human-review process, notices, material-update tracking and record retention.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
SB26-189
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsUnited States - California / Law
California Transparency in Frontier Artificial Intelligence Act
Frontier developers and large frontier developers meeting statutory model/developer thresholds. Not a general certification requirement for enterprise AI users.
Duties, evidence, limitations & official sources
Status / timing
In force; frontier-developer and large-frontier-developer classifications control
Duties / expectations
Requires covered safety frameworks, transparency disclosures, critical-safety-incident reporting and whistleblower protections. Disclosure duties differ by developer category.
Evidence to consider
Frontier-model threshold assessment, approved framework, evaluation records, release disclosures, incident reporting procedure and protected employee reporting.
Scope qualification
The Attorney General describes framework, incident and employee-reporting provisions. Separate the developer categories; this is not a general certification obligation for every enterprise using an AI tool.
Source locator
Business & Professions Code 22757.10 et seq.; Labor Code 1107 and 1107.1
Review limitation
Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services termsUnited States - California / Law
California AI Transparency Act - SB942, AB853 and 2026 amendments
Generative-AI providers and staged platform/hosting/device requirements. The Governor confirms signing SB1000 and AB2713 on September 30, 2026, further amending the transparency regime. Do not rely on the older provider definition or user threshold without checking the amended text.
Duties, evidence, limitations & official sources
Status / timing
Operative statute; September 30, 2026 amendments require consolidated-text review before reliance
Duties / expectations
The regime addresses synthetic-content provenance, disclosures and verification/detection capabilities, with actor-specific requirements. AB853 introduced a chapter-wide August 2, 2026 operative date and staged platform/device requirements. The September 2026 legislation further changes the regime. The chaptered/consolidated text was not retrievable in this review, so exact amended thresholds, exceptions and commencement details remain an explicit validation item.
Evidence to consider
Provider/platform classification, provenance tests, disclosure persistence, detection access and staged implementation records.
Scope qualification
Publication boundary: enactment and the subject of the amendments are supported by the official signing announcement. This entry does not certify the post-September 30 requirements or assume that all original SB942 duties remain unchanged.
Source locator
Business & Professions Code Chapter 25; SB942 / AB853; SB1000 and AB2713 (2026)
Review limitation
Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services termsUnited States - New York / Law
New York Responsible AI Safety and Education (RAISE) Act
Frontier and large frontier developers within Article 44-B definitions and scope; applicability is not equivalent to deploying any enterprise LLM.
Duties, evidence, limitations & official sources
Status / timing
Enacted; operative January 1, 2027
Duties / expectations
Creates transparency, safety-incident reporting, disclosure and related accountability obligations. Use the amended consolidated law rather than an earlier bill version.
Evidence to consider
Compute/revenue threshold analysis, safety framework, disclosure approvals, critical-incident escalation and preservation of evaluation evidence.
Scope qualification
Article 44-B applies to defined large developers and covered frontier models, not every New York AI user. Confirm statutory thresholds, exemptions and implementing directions before treating an enterprise deployment as covered.
Source locator
GBL 1420-1429
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services termsUnited States - New York / Regulation
NYDFS Cybersecurity Regulation
Entities operating under covered NY financial-services laws; limited exemptions and Class A requirements require a documented scope determination.
Duties, evidence, limitations & official sources
Status / timing
In force; amended requirements and exemptions apply
Duties / expectations
Requires a risk-based cybersecurity program, policies, CISO/governing-body oversight, controls, incident reporting and annual compliance submission. AI data flows and suppliers belong in the risk assessment.
Evidence to consider
Board reporting, asset inventory, risk assessment, control tests, MFA/PAM evidence, incident decisions, recovery tests and third-party reviews.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
23 NYCRR Part 500
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsUnited States - federal / Law / regulation
GLBA and FTC Safeguards Rule
Financial institutions subject to the FTC's GLBA jurisdiction, including covered nonbank financial activities. Banking-agency rules govern other covered institutions.
Duties, evidence, limitations & official sources
Status / timing
In force
Duties / expectations
Requires a written security program led by a qualified individual, risk assessment, safeguards, service-provider oversight and reporting. Specific notification duties have their own trigger.
Evidence to consider
Written program, governing-body reports, inventory, encryption/MFA rationale, testing, supplier monitoring and incident-notification record.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
16 CFR 314
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsUnited States - federal / Regulation
SEC Regulation S-P
Covered broker-dealers, funding portals, investment companies, SEC-registered investment advisers and covered transfer agents. Size classifications differ by registrant type; the adviser AUM threshold is not a universal threshold for all entities.
Duties, evidence, limitations & official sources
Status / timing
2024 amendments: larger entities December 3, 2025; smaller entities June 3, 2026; both dates elapsed
Duties / expectations
Requires written incident-response policies, safeguards/disposal, service-provider oversight and compliance records. Covered notification is due as soon as practicable, generally no later than 30 days after awareness of the triggering unauthorized access/use, subject to the rule's investigation-based exception and authorized delay provisions. Do not equate every security alert with the notification trigger.
Evidence to consider
Incident-response program, affected-information analysis, notice decisions, service-provider records, retention and supervisory review.
Scope qualification
Verify the affected information and covered individuals before deciding notice. A contract alone does not demonstrate service-provider oversight.
Source locator
17 CFR Part 248
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services termsUnited States - federal / Regulation
SEC cybersecurity disclosure rules
Public-company registrants subject to the relevant Exchange Act reporting forms; domestic and foreign private issuer mechanisms differ.
Duties, evidence, limitations & official sources
Status / timing
In force for covered registrants
Duties / expectations
Requires specified material incident disclosures and periodic descriptions of cyber risk management, strategy and governance. The materiality determination and disclosure timetable are distinct from technical incident severity.
Evidence to consider
Documented materiality/escalation process, disclosure controls, board/management role evidence and consistency between filings and actual practice.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Regulation S-K Item 106; Form 8-K Item 1.05
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsUnited States - federal / Supervisory guidance
Interagency model risk management guidance - SR26-2
Interagency guidance most relevant to supervised banking organizations with more than $30 billion in total assets; smaller organizations with significant model exposure should consider applicability. The guidance covers complex quantitative models, including non-generative, non-agentic AI models. Footnote 3 expressly excludes generative and agentic AI from its scope.
Duties, evidence, limitations & official sources
Status / timing
Issued April 17, 2026; supersedes SR11-7 and SR21-8
Duties / expectations
Recommends risk-based model development, use, validation and governance. It does not create enforceable legal requirements and must not be represented as a generative-AI or agentic-AI compliance framework. Separate governance, consumer-protection, privacy, safety-and-soundness and contractual duties may still apply to those uses.
Evidence to consider
Model inventory, materiality and limitations, independent challenge, validation, change control and risk acceptance.
Scope qualification
Keep the covered-model inventory distinct from the broader AI-system inventory. Exclusion from this guidance is not exemption from other law or sound risk management.
Source locator
SR26-2, April 17, 2026; applicability statement and revised guidance footnotes 1 and 3
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services termsUnited States - federal / Supervisory guidance
Interagency third-party relationship risk management
Banking organizations supervised by the Federal Reserve, FDIC or OCC; lifecycle practices scaled to the risk of each relationship.
Duties, evidence, limitations & official sources
Status / timing
Final interagency guidance, 2023
Duties / expectations
Addresses planning, diligence, contracting, monitoring and termination. AI-model APIs, cloud platforms and data/agent suppliers should be evaluated as relationships, not just purchased software.
Evidence to consider
Risk tiering, diligence exceptions, enforceable audit/incident/exit terms, monitoring evidence and termination plans.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
SR23-4
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsUnited States - federal / Law / regulation
Equal Credit Opportunity Act / Regulation B
Covered creditors making credit decisions, including AI-enabled underwriting. Technology choice does not eliminate statutory notification duties.
Duties, evidence, limitations & official sources
Status / timing
In force; current regulation controls
Duties / expectations
Prohibits specified discrimination and requires accurate principal reasons for adverse actions. Use the current regulation; agency circulars are interpretation, not the statute itself.
Evidence to consider
Credit decision provenance, reason-code validation, fair-lending testing and adverse-action notices.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
12 CFR 1002, especially 1002.9
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsUnited States - federal / Law
Fair Credit Reporting Act
Consumer reporting agencies, furnishers and users of consumer reports as defined; AI scoring vendors can create reporting-law obligations depending on their actual functions.
Duties, evidence, limitations & official sources
Status / timing
In force
Duties / expectations
Regulates permissible purpose, accuracy, disputes and relevant notices. Employment screening and eligibility scoring need classification before deployment.
Evidence to consider
Purpose controls, accuracy/dispute workflows, source lineage, notice records and vendor-role analysis.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
15 USC 1681 et seq.
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsUnited States - federal / Law / regulation
Bank Secrecy Act / AML program requirements
Covered financial institutions, including covered MSBs. AML program, customer due-diligence and reporting obligations differ by institution type.
Duties, evidence, limitations & official sources
Status / timing
In force; institution-specific rules apply
Duties / expectations
AI-assisted monitoring does not transfer accountability for required programs, suspicious activity reporting or recordkeeping. Protect confidentiality and validate alert/decision workflows.
Evidence to consider
AML governance, risk assessment, model/threshold validation, investigator records, independent testing and SAR handling controls.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
31 USC 5311 et seq.; 31 CFR Chapter X
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsUnited States - federal / Law / regulation
US economic sanctions / OFAC compliance
US persons and transactions subject to applicable sanctions jurisdiction; extraterritorial and secondary-sanctions issues are fact-specific.
Duties, evidence, limitations & official sources
Status / timing
In force; program-specific rules change frequently
Duties / expectations
AI-enabled onboarding, payment, supplier or export workflows must respect applicable prohibitions. A screening score is not a legal determination or a substitute for escalation.
Evidence to consider
Current list/program screening, false-positive review, licensing analysis, escalation and auditable transaction decisions.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Applicable sanctions program regulations
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsUnited States - state insurance / Model / adoption-dependent
NAIC model bulletin on insurer use of AI
Insurers in states adopting the bulletin or related guidance. NAIC publication alone is not a nationwide enforceable statute.
Duties, evidence, limitations & official sources
Status / timing
Model bulletin; state adoption and variations control
Duties / expectations
Calls for a written AI-systems program, governance, risk controls, testing and documentation supporting compliance with insurance law. Third-party systems remain relevant to insurer accountability.
Evidence to consider
AI inventory, consumer-impact review, written program, validation, vendor evidence and state-by-state applicability matrix.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
AI Model Bulletin; individual state adoption
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsInternational / payment ecosystem / Standard / contractual
PCI DSS v4.0.1
Entities storing, processing or transmitting payment-card account data, and entities able to affect its security, as scoped by payment-brand/acquirer obligations.
Duties, evidence, limitations & official sources
Status / timing
Contractual standard; not a general statute
Duties / expectations
Requires scoped controls for account-data security, access, testing, monitoring and secure development. AI integrations can alter scope or create unauthorized storage.
Evidence to consider
Card-data flow maps, segmentation tests, access reviews, vulnerability management and assessment evidence.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
PCI DSS v4.0.1; future-dated requirements applied March 31, 2025
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsUnited States - federal / Law / regulation
HIPAA Privacy and Breach Notification Rules
Covered entities and business associates handling protected health information. Not every wellness app or AI-generated health inference is HIPAA-covered.
Duties, evidence, limitations & official sources
Status / timing
In force; scope and exceptions are specific
Duties / expectations
Limits uses/disclosures and establishes individual rights and breach-notification duties. AI vendors require appropriate roles, contracts and permitted purposes.
Evidence to consider
BAAs, minimum-necessary analysis, access/amendment workflows, risk-of-compromise assessment and notice decisions.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
45 CFR Parts 160 and 164
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsUnited States - federal / Regulation
HIPAA Security Rule
Covered entities and business associates safeguarding electronic PHI. Security-rule obligations are separate from general medical-device and consumer-app regulation.
Duties, evidence, limitations & official sources
Status / timing
Existing rule in force; do not treat the 2025 NPRM as final law
Duties / expectations
Requires administrative, physical and technical safeguards, risk analysis and risk management. Assess AI data stores, remote processing, model access and incident response.
Evidence to consider
ePHI inventory, risk analysis, access controls, audit records, contingency tests and vendor safeguards.
Scope qualification
The existing Security Rule remains the operative baseline in the reviewed HHS material. The January 2025 strengthening proposal is not labeled final here; verify any subsequent final rule and compliance date before presenting proposed controls as current law.
Source locator
45 CFR 164 Subpart C
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services termsUnited States - federal / Law / rulemaking
Cyber Incident Reporting for Critical Infrastructure Act
Entities and incidents ultimately covered by CISA's implementing regulations. Consult the live rulemaking record before assigning a compliance start date.
Duties, evidence, limitations & official sources
Status / timing
Implementing final rule under OIRA review; no operative final-rule reporting commencement verified
Duties / expectations
CIRCIA authorizes covered-entity cyber-incident and ransom-payment reporting. OIRA record RIN 1670-AA04 shows a final-rule submission received October 1, 2026 under pending review. A submission for review is not a published effective final rule. Do not present the statutory 72-hour/24-hour framework as a currently operative reporting duty for every critical-infrastructure organization.
Evidence to consider
Coverage watchlist, notification decision tree, preservation capabilities and reconciliation with other reporting regimes.
Scope qualification
Existing sector-specific, state, contractual and federal reporting duties continue independently. Check the Federal Register final text and effective/compliance dates before activating a CIRCIA reporting clock.
Source locator
CIRCIA; RIN 1670-AA04; OIRA review record 1550967
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services termsUnited States - Delaware / Case law
Delaware fiduciary oversight jurisprudence
Directors/officers and entities governed by relevant Delaware law. Applicable duties, exculpation and pleading standards require case-specific advice.
Duties, evidence, limitations & official sources
Status / timing
Fact-specific; not automatic liability after an incident
Duties / expectations
Good-faith oversight includes appropriate reporting systems and responses to significant warnings in context. An adverse AI outcome alone does not establish a fiduciary breach.
Evidence to consider
Board information flows, mission-critical risk escalation, documented challenge, resourcing and follow-through on identified deficiencies.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Caremark / Stone / Marchand line of authority
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsEuropean Union / EEA relevance / Regulation
European Union Artificial Intelligence Act
Providers, deployers, importers, distributors and other covered actors; certain non-EU actors are included. System role, prohibited use, high-risk classification and GPAI status determine duties.
Duties, evidence, limitations & official sources
Status / timing
In force; current amended application dates and legacy-system transitions differ by provision
Duties / expectations
AI literacy and most prohibitions have applied since February 2, 2025; GPAI and specified governance provisions since August 2, 2025. Many transparency duties apply from August 2, 2026. Under the current consolidated Article 113 display, Annex III high-risk duties apply December 2, 2027 and Annex I product-related high-risk duties August 2, 2028. Article 111 gives pre-August 2, 2026 systems a December 2, 2026 transition for Article 50(2) marking/detection; new Article 5 prohibitions also have that later date.
Evidence to consider
Role/use-case classification, AI inventory, risk and data governance, oversight, logs, supplier documentation, testing and change/incident records.
Scope qualification
These are not one universal compliance date. Classify actor, use case, product regime, market-placement date, legacy status and subsequent changes. The Commission Service Desk displays the July 27, 2026 consolidated version; its summaries are explanatory, not a substitute for the legal text.
Source locator
Regulation (EU) 2024/1689 as amended
Review limitation
Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services termsEuropean Union / EEA / Regulation
General Data Protection Regulation
Controllers/processors within Article 3 territorial scope; non-EU establishments can be covered by offering goods/services or monitoring people in the Union.
Duties, evidence, limitations & official sources
Status / timing
Applicable since May 25, 2018
Duties / expectations
Requires lawful, fair and transparent processing, minimization, security, rights and accountability. Assess DPIAs, Article 22 safeguards, special-category data and international transfers for relevant AI use.
Evidence to consider
ROPA, lawful-basis analysis, DPIA, processor terms, transfer assessments, rights handling, security testing and breach decisions.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Articles 5-6, 9, 12-22, 25, 28, 30, 32-35, 44-49
Review limitation
Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsEuropean Union / Directive / national law
ePrivacy Directive and national implementing laws
Electronic communications and related storage/access or direct-marketing activities under applicable member-state legislation.
Duties, evidence, limitations & official sources
Status / timing
National implementation controls
Duties / expectations
Addresses communications confidentiality, terminal-equipment storage/access and marketing rules. Consent exceptions and national implementations must be assessed rather than treating all analytics as automatically exempt.
Evidence to consider
Cookie/SDK inventory, consent and exemptions analysis, preference controls, marketing lists and vendor configurations.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Directive 2002/58/EC as amended
Review limitation
October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsEuropean Union / Regulation
Digital Operational Resilience Act
Covered financial entities and designated critical ICT third-party providers, subject to the Act's proportionality/exemptions and implementing measures.
Duties, evidence, limitations & official sources
Status / timing
Applicable since January 17, 2025
Duties / expectations
Requires ICT risk governance, incident reporting, resilience testing and third-party controls. AI providers and cloud dependencies must be considered in the ICT service and concentration-risk model.
Evidence to consider
ICT register, management-body decisions, critical-function mapping, contract clauses, testing and incident classification/reporting records.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Regulation (EU) 2022/2554; Articles 5-16, 17-23, 24-30
Review limitation
October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsUnited Kingdom / Law
UK GDPR / Data Protection Act 2018 / DUAA 2025
Controllers/processors within UK territorial scope. The UK regime is not identical to the EU GDPR after domestic amendments.
Duties, evidence, limitations & official sources
Status / timing
UK GDPR and DPA in force; all DUAA data-protection provisions in force by June 19, 2026
Duties / expectations
The DUAA amends rather than replaces UK GDPR, DPA 2018 and PECR. Significant automated decisions still require safeguards, with additional protection for special-category data. Organizations must facilitate data-protection complaints, acknowledge them within 30 days and respond without undue delay. UK lawful-basis, rights and transfer analysis must be distinct from EU GDPR analysis.
Evidence to consider
UK-specific lawful-basis/DPIA review, meaningful contest/review, notices, complaints and transfer documentation.
Scope qualification
Current status and changes checked against the ICO's June 19, 2026 update. The underlying UK legislation page was not assessed clause by clause; the ICO summary does not establish applicability to every overseas operator.
Source locator
UK GDPR as amended; DPA 2018; DUAA 2025
Review limitation
Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services termsUnited Kingdom / Regulation
Privacy and Electronic Communications Regulations
Electronic marketing and covered communications/terminal-equipment activities. Apply current exemptions and DUAA-related changes.
Duties, evidence, limitations & official sources
Status / timing
In force as amended
Duties / expectations
Governs marketing communications and storage/access technologies alongside UK data-protection law. A banner alone is not evidence that tracking respects consent.
Evidence to consider
Cookie/SDK audit, lawful-exemption register, consent records and suppression lists.
Scope qualification
DUAA amends PECR. Any storage/access exception is purpose- and safeguard-specific; it does not permit unrestricted tracking, profiling or advertising cookies without the otherwise required consent. Consult the current ICO storage/access guidance.
Source locator
SI 2003/2426 as amended
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services termsUnited Kingdom / Regulation / supervisory rules
FCA operational resilience rules
FCA firms within SYSC 15A scope and corresponding prudential requirements where applicable.
Duties, evidence, limitations & official sources
Status / timing
In force; March 31, 2025 transition completed for covered firms
Duties / expectations
Requires identification of important business services, impact tolerances, mapping, scenario testing and remediation. AI and cloud concentration must be assessed at service level.
Evidence to consider
Important-service map, tolerance approvals, severe-but-plausible tests, third-party dependencies and self-assessment.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
FCA SYSC 15A; related PRA rules
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsUnited Kingdom / Regulation / supervisory rules
FCA Consumer Duty
Firms and products/services within the FCA's retail-market scope, including relevant distribution-chain roles.
Duties, evidence, limitations & official sources
Status / timing
In force for covered retail business
Duties / expectations
Requires focus on good retail-customer outcomes, including understanding and support. AI-driven pricing, personalization or support should be tested against customer harm, not only efficiency.
Evidence to consider
Outcome monitoring, vulnerability analysis, product reviews, customer comprehension/support testing and governing-body oversight.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Principle 12; PRIN 2A
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsCanada - federal private sector / Law
PIPEDA
Commercial personal-information processing within federal scope and cross-border activity; exemptions and provincial allocation require review.
Duties, evidence, limitations & official sources
Status / timing
In force; substantially similar provincial regimes may apply
Duties / expectations
Requires accountable, appropriate collection/use/disclosure, consent, safeguards, access/correction and qualifying breach reporting/records.
Evidence to consider
Purpose/consent records, privacy officer accountability, security, vendor controls and significant-harm assessment.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
S.C. 2000, c.5
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsCanada - Quebec / Law
Quebec private-sector privacy law (Law 25 reforms)
Enterprises holding personal information within Quebec private-sector law; separate public-sector statute applies to public bodies.
Duties, evidence, limitations & official sources
Status / timing
Reforms phased through 2024; current consolidated law controls
Duties / expectations
Requires privacy governance, impact assessments for specified systems/transfers, transparency for exclusively automated decisions and individual rights.
Evidence to consider
Privacy roles, PIA/transfer assessments, notices, decision-review mechanisms and retention/destruction evidence.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Act respecting the protection of personal information in the private sector
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsCanada - federally regulated finance / Supervisory guidance
OSFI B-13 - technology and cyber risk
Federally regulated financial institutions and relevant foreign branches, applied proportionately to their Canadian operations.
Duties, evidence, limitations & official sources
Status / timing
Current supervisory guideline
Duties / expectations
Expects governance, technology operations/resilience and cyber-security management. Senior management must assign clear responsibilities and maintain risk-based controls.
Evidence to consider
Technology inventory, board reporting, secure development/change records, incident response, recovery and supplier controls.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Guideline B-13
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsAustralia / Law
Australian Privacy Act and Australian Privacy Principles
APP entities including covered agencies/businesses; turnover and sector exceptions matter. Not every small business is exempt.
Duties, evidence, limitations & official sources
Status / timing
In force; new ADM privacy-policy duties commence December 10, 2026
Duties / expectations
Requires open/transparent management, purpose limits, quality, security and access/correction. New APP 1 automated-decision disclosures address significant decisions involving personal information.
Evidence to consider
APP scope, data maps, privacy policy, collection notices, ADM inventory, access/correction and breach response.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Privacy Act 1988; APPs; Notifiable Data Breaches scheme
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsAustralia / Prudential standard
APRA CPS 234 - Information Security
APRA-regulated entities, with responsibilities for information assets managed by related parties and third parties.
Duties, evidence, limitations & official sources
Status / timing
Mandatory for covered APRA entities
Duties / expectations
Requires security capability, implementation/testing of controls and notification of qualifying incidents/control weaknesses. Governing-body accountability is explicit.
Evidence to consider
Information classification, control testing, board oversight, third-party assurance and notification decisions.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Prudential Standard CPS 234
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsAustralia / Prudential standard
APRA CPS 230 - Operational Risk Management
Covered APRA-regulated entities; current standard and service-provider transition arrangements apply.
Duties, evidence, limitations & official sources
Status / timing
Current version in force July 1, 2026
Duties / expectations
Requires operational-risk controls, critical-operation tolerances, continuity and material-service-provider management. Boards approve key plans and oversee remediation.
Evidence to consider
Critical operations map, tolerance decisions, scenario tests, service-provider agreements and board reporting.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Prudential Standard CPS 230
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsSingapore / Law
Singapore Personal Data Protection Act
Organizations processing personal data within PDPA scope; public agencies have a different governance regime.
Duties, evidence, limitations & official sources
Status / timing
In force
Duties / expectations
Requires accountability, notice/consent or applicable exceptions, purpose limitation, security, retention limits, access/correction, transfer controls and qualifying breach notification.
Evidence to consider
DPO accountability, purpose/exception analysis, vendor terms, security/retention records and rights handling.
Scope qualification
Source-review boundary (September 17, 2026): Direct full text was not retrievable; the entry is orientation only. No assumption that a planned rule is operative.
Source locator
Personal Data Protection Act 2012
Review limitation
October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsSingapore / Regulatory guidance
Singapore PDPC guidance on AI use of personal data
Organizations developing/deploying AI systems using personal data, including recommendations, decisions and generative uses where PDPA applies.
Duties, evidence, limitations & official sources
Status / timing
Guidance interprets existing PDPA duties; not a separate AI statute
Duties / expectations
Explains personal-data use across development and deployment, including purposes, consent/exceptions and information to individuals. Model architecture does not remove data-protection duties.
Evidence to consider
Data-purpose and lawful-use register, notices, safeguards, testing and vendor accountability.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
2024 AI advisory guidelines; check later PDPC supplements
Review limitation
October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsSingapore / Supervisory guidance
MAS Technology Risk Management Guidelines
Financial institutions within MAS supervision, with institution-specific cyber hygiene and technology notices where applicable.
Duties, evidence, limitations & official sources
Status / timing
January 2021 Technology Risk Management Guidelines; current official publication page accessible
Duties / expectations
Sets governance, secure development, operations, resilience and cyber-risk expectations. AI outsourcing and model services should fit the technology-risk framework.
Evidence to consider
Technology governance, secure design/testing, critical-service mapping, outsourcing diligence and incident/recovery evidence.
Scope qualification
The official guidance page was accessible on October 13, 2026, resolving the earlier retrieval limitation. Separate the guidelines from binding notices applicable to a particular licensee and from incident-notification instructions.
Source locator
TRM Guidelines and relevant MAS notices
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services termsJapan / Law
Japan Act on the Protection of Personal Information
Business operators and other entities within APPI scope; overseas handling and cross-border transfers have specific requirements.
Duties, evidence, limitations & official sources
Status / timing
In force as amended; Japanese original controls
Duties / expectations
Requires specified purposes, appropriate acquisition/security, rights handling and controls on third-party/cross-border provision. AI data processing needs purpose and transfer review.
Evidence to consider
Purpose notices, special-care information handling, third-party records, security, rights and breach decisions.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
APPI and PPC rules/guidelines
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsChina / Law
China Personal Information Protection Law
Personal-information handlers within territorial/extraterritorial statutory scope. Localization and transfer obligations depend on thresholds and current implementing measures.
Duties, evidence, limitations & official sources
Status / timing
In force; official Chinese text controls
Duties / expectations
Requires lawful processing, notice/consent or other grounds, rights, security and relevant impact assessments. Automated decisions have transparency/fairness and contest-related protections.
Evidence to consider
Processing grounds, sensitive-data assessment, automated-decision review, transfer mechanism and rights evidence.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
PIPL, including Article 24
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsChina / Law
China Data Security Law
Data activities within statutory scope, with important/core-data and national-security implications beyond personal information.
Duties, evidence, limitations & official sources
Status / timing
In force; classification/export rules require current local review
Duties / expectations
Requires classification-based data security and risk management, with additional duties for relevant important-data processing. Distinguish personal-information and industrial/security data requirements.
Evidence to consider
Data classification, risk assessments, access controls, incident handling and cross-border authorization analysis.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Data Security Law 2021
Review limitation
October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsChina / Regulation
China Interim Measures for Generative AI Services
Generative AI services provided to the public in China; the measures exclude certain nonpublic internal research/application uses from their specific scope.
Duties, evidence, limitations & official sources
Status / timing
Effective August 15, 2023
Duties / expectations
Addresses lawful training sources, personal information/IP, content obligations, service protection and oversight. Other cyber/data/sector laws still apply to excluded internal use.
Evidence to consider
Dataset provenance, consent/rights, content safeguards, complaint/incident handling and provider filing/security assessment where applicable.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
CAC and six other agencies, Order 15
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsIndia / Law / regulation
India Digital Personal Data Protection Act and Rules
Digital personal-data processing within the Act's territorial/extraterritorial scope. Confirm which statutory/rule provisions have commenced before treating all duties as operative.
Duties, evidence, limitations & official sources
Status / timing
Rules notified November 2025; phased 18-month implementation
Duties / expectations
Provides notice/consent and specified legitimate uses, data-fiduciary safeguards, individual rights, breach handling and additional duties for designated significant data fiduciaries.
Evidence to consider
Data-purpose/consent records, security controls, child-data review, rights/grievance workflow and phased compliance plan.
Scope qualification
The official November 2025 government explanation describes an 18-month phased implementation. The MeitY page did not yield readable current text in this review; consult the Gazette commencement notifications for the exact provisions operative on the relevant date. Do not label every substantive duty already effective.
Source locator
DPDP Act 2023; Rules 2025; commencement notifications
Review limitation
Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services termsIndia / Regulatory direction
India CERT-In cybersecurity directions
Covered service providers, intermediaries, data centers, bodies corporate and government organizations; additional duties apply to specified services.
Duties, evidence, limitations & official sources
Status / timing
2022 directions; applicable scope and exemptions matter
Duties / expectations
Requires specified incident reporting, log retention, time synchronization and other records. Map Indian legal duties to overseas cloud/AI service architectures.
Evidence to consider
Incident classification/escalation, log availability, time controls, contact designation and required subscriber records.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
IT Act Section 70B directions, April 28, 2022
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsBrazil / Law
Brazil General Personal Data Protection Law
Personal-data processing within LGPD nexus; different lawful bases and public/private-sector rules may apply.
Duties, evidence, limitations & official sources
Status / timing
In force; ANPD regulations supplement the law
Duties / expectations
Requires legal basis, transparency, data-subject rights, safeguards and accountability. Article 20 addresses review of solely automated decisions affecting interests.
Evidence to consider
Legal-basis register, rights/review workflow, security, transfer controls and impact reports where required.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Law 13.709/2018 as amended
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsSouth Africa / Law
South Africa Protection of Personal Information Act
Responsible parties and operators within POPIA scope; special personal information and child data have additional constraints.
Duties, evidence, limitations & official sources
Status / timing
In force
Duties / expectations
Sets processing conditions, security safeguards, rights, cross-border rules and restrictions on specified automated decisions.
Evidence to consider
Information-officer governance, purpose/ground records, operator contracts, safeguards, rights and compromise notifications.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
Act 4 of 2013; Section 71 automated decisions
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsSwitzerland / Law
Swiss Federal Act on Data Protection
Private persons and federal bodies within FADP scope; cantonal public-sector regimes can differ.
Duties, evidence, limitations & official sources
Status / timing
Revised Act effective September 1, 2023
Duties / expectations
Requires proportionate transparent processing, security, rights and relevant DPIAs; covers specified automated decisions and international disclosures.
Evidence to consider
Processing inventory, notices, impact assessments, automated-decision review, transfers and breach escalation.
Scope qualification
Source-review boundary (September 17, 2026): Direct full text was not retrievable; the entry is orientation only. No assumption that a planned rule is operative.
Source locator
Federal Act on Data Protection of September 25, 2020
Review limitation
October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsNew Zealand / Law
New Zealand Privacy Act
Agencies and organizations within statutory scope, including relevant overseas agencies carrying on business in New Zealand.
Duties, evidence, limitations & official sources
Status / timing
Privacy Act 2020 in force; IPP3A indirect-collection notice commenced May 1, 2026
Duties / expectations
Privacy principles govern collection, notice, security, accuracy, rights, retention, use, disclosure and overseas transfers. New IPP3A extends notice obligations to covered indirect collection.
Evidence to consider
Privacy notices, indirect-data provenance, security, access/correction, serious-harm breach assessment and transfer controls.
Scope qualification
IPP3A adds an indirect-collection notification duty subject to its exceptions. Existing principles, including the conditions for collecting indirectly, remain relevant; notice is not a blanket permission to collect.
Source locator
Privacy Act 2020; Privacy Amendment Act 2025
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services termsUnited States - NIST / Standard / framework
NIST AI Risk Management Framework 1.0
Organizations designing, developing, deploying or using AI; voluntary unless incorporated into law, procurement or contract.
Duties, evidence, limitations & official sources
Status / timing
AI RMF 1.0 remains the published final framework; revision work is ongoing
Duties / expectations
Organizes work through Govern, Map, Measure and Manage; trustworthiness is contextual and involves trade-offs. It does not certify an AI system or replace jurisdiction-specific law.
Evidence to consider
AI inventory, risk governance, evaluations, response plans, ownership and documented residual risk.
Scope qualification
NIST states that AI RMF 1.0 is being revised. A revision project or critical-infrastructure concept note is not a final replacement framework or a certification program.
Source locator
AI RMF 1.0 / NIST AI 100-1
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services termsUnited States - NIST / Standard / framework
NIST Generative AI Profile
Organizations using generative models and applications; companion profile to the AI RMF.
Duties, evidence, limitations & official sources
Status / timing
NIST AI600-1 final, July 26, 2024; voluntary Generative AI Profile
Duties / expectations
Identifies generative-AI risks and potential actions, including content integrity, privacy, security, value-chain and information risks. Actions need context-specific selection.
Evidence to consider
Threat/use-case analysis, test plans, content provenance, supplier evidence and monitoring.
Scope qualification
The profile supplements AI RMF 1.0 and recommends risk-management actions. It is not a universal safety guarantee or an independent certification scheme.
Source locator
NIST AI 600-1
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services termsUnited States - NIST / Standard / framework
NIST Cybersecurity Framework
Organizations managing cyber risk, including business processes supported by AI.
Duties, evidence, limitations & official sources
Status / timing
Published guidance or standard; binding only where adopted
Duties / expectations
Provides Govern, Identify, Protect, Detect, Respond and Recover outcomes. Profiles and tiers guide communication; mapping a control is not proof that an outcome is achieved.
Evidence to consider
Current/target profiles, risk priorities, control evidence and improvement tracking.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
CSF 2.0
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsUnited States - NIST / Standard / framework
NIST Privacy Framework - final 1.0 / draft 1.1
Organizations managing privacy risk across data-processing ecosystems.
Duties, evidence, limitations & official sources
Status / timing
Version 1.0 final; version 1.1 Initial Public Draft remains draft in the reviewed publication record
Duties / expectations
Connects data-processing activities to privacy outcomes and governance. It is voluntary and distinct from a checklist for GDPR or US state-law compliance.
Evidence to consider
Data processing maps, privacy risk assessment, controls and communication.
Scope qualification
Use 1.0 as the final adoption baseline unless an organization explicitly adopts draft material. A closed comment period does not make version 1.1 final.
Source locator
Privacy Framework 1.0; NIST CSWP40 (1.1 Initial Public Draft)
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services termsUnited States - NIST / Standard / framework
NIST SP800-53 Rev.5 - security and privacy controls
Information systems within adopted security/privacy baselines; federal use and nonfederal contractual uses differ.
Duties, evidence, limitations & official sources
Status / timing
Revision 5 final; minor Release 5.2.0 issued August 27, 2025
Duties / expectations
Defines control families for access, audit, assessment, incident response and more. Tailoring, implementation and assessment are required; a crosswalk alone proves nothing.
Evidence to consider
Control applicability, implementation statements, assessments, POA&M and continuous monitoring.
Scope qualification
Select and tailor controls under the applicable authorization/risk process. A minor catalog release is not automatic amendment of every existing contract, authorization baseline or organizational control set.
Source locator
SP 800-53 Rev.5 with updates
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services termsUnited States - NIST / Standard / framework
NIST SSDF - SP800-218 v1.1 / v1.2 draft
Software producers and acquirers, including AI harnesses, toolchains and dependencies.
Duties, evidence, limitations & official sources
Status / timing
SSDF v1.1 final (2022); SP800-218 Rev. 1 / SSDF v1.2 Initial Public Draft (December 2025)
Duties / expectations
Recommends secure development practices and vulnerability response throughout the lifecycle. Contractual attestations and acquisition requirements are separate obligations.
Evidence to consider
Secure builds, code review, provenance, dependency controls, testing and vulnerability records.
Scope qualification
SP800-218A is a separate final AI-model development profile. Do not describe SSDF v1.2 draft practices as an adopted contractual requirement unless the relevant instrument expressly incorporates them.
Source locator
SP800-218 final; SP800-218 Rev.1 Initial Public Draft; SSDF publications list
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services termsUnited States - NIST / Standard / framework
NIST incident response recommendations
Organizations integrating cyber incident response into risk management.
Duties, evidence, limitations & official sources
Status / timing
SP800-61 Rev.3 final, April 2025; a CSF 2.0 Community Profile
Duties / expectations
Connects preparation, detection, response and recovery with CSF 2.0. Use for agentic containment and evidence plans, not as a substitute for mandatory notification rules.
Evidence to consider
Incident playbooks, exercise records, containment authorization, recovery verification and lessons learned.
Scope qualification
Revision 3 supersedes Revision 2. Adapt response activities to the organization; the publication is not itself a statutory incident-notification timetable.
Source locator
SP 800-61 Rev.3
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services termsUnited States - NIST / Standard / framework
NIST post-quantum cryptography standards
Cryptographic implementations and organizations with mandated or risk-based migration needs.
Duties, evidence, limitations & official sources
Status / timing
Published guidance or standard; binding only where adopted
Duties / expectations
Standardizes ML-KEM key encapsulation and ML-DSA/SLH-DSA signatures. Standards do not by themselves certify a whole product or mandate a single global migration date.
Evidence to consider
Cryptographic inventory, data-secrecy horizon, vendor readiness, interoperability and migration testing.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
FIPS 203, 204 and 205
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsInternational / technical framework / Standard / framework
ISO/IEC 42001 AI management systems
Organizations adopting an AI management system, optionally subject to independent certification.
Duties, evidence, limitations & official sources
Status / timing
ISO/IEC 42001:2023; voluntary management-system standard unless incorporated
Duties / expectations
Specifies management-system requirements for responsible AI development/use and continual improvement. Certification scope does not establish universal AI Act or product compliance.
Evidence to consider
AI policy, roles, risks/impacts, objectives, operational controls, audits and corrective action.
Scope qualification
Publisher summary reviewed, not the licensed full standard. Certification concerns a defined management-system scope; it does not establish the safety or legal compliance of every model, product or use case.
Source locator
ISO/IEC 42001:2023
Review limitation
Source check covers publication identity and available summary, not a licensed clause-by-clause assessment.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services termsInternational / technical framework / Standard / framework
ISO/IEC 23894 AI risk management
Organizations managing risks associated with AI products, systems and services.
Duties, evidence, limitations & official sources
Status / timing
ISO/IEC 23894:2023 risk-management guidance
Duties / expectations
Provides risk-management guidance tailored to AI. It is not a standalone certifiable management-system requirement.
Evidence to consider
Risk criteria, assessments, treatments, monitoring and stakeholder communication.
Scope qualification
Publisher abstract reviewed; licensed full text not assessed. Guidance does not create a standalone AI product certification or substitute for applicable legal duties.
Source locator
ISO/IEC 23894:2023
Review limitation
Source check covers publication identity and available summary, not a licensed clause-by-clause assessment.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services termsInternational / technical framework / Standard / framework
ISO/IEC 27001 information security management
Organizations establishing an information security management system.
Duties, evidence, limitations & official sources
Status / timing
ISO/IEC 27001:2022 information-security management-system standard
Duties / expectations
Requires risk-based management, scoped controls and continual improvement. An ISMS certificate does not mean every AI use or vendor has been technically validated.
Evidence to consider
ISMS scope, risk treatment, statement of applicability, audits and corrective actions.
Scope qualification
Publisher summary reviewed; licensed normative text and applicable amendments require an authorized copy. A certificate must be checked for scope, issuing body and validity; it is not evidence that all controls always operate.
Source locator
ISO/IEC 27001:2022
Review limitation
Source check covers publication identity and available summary, not a licensed clause-by-clause assessment.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services termsInternational / technical framework / Standard / framework
OWASP AI security guidance
Teams threat-modeling, testing and operating generative and agentic applications.
Duties, evidence, limitations & official sources
Status / timing
Published guidance or standard; binding only where adopted
Duties / expectations
Catalogs risks such as injection, supply-chain compromise, excessive agency and insecure output handling. It is community technical guidance, not legislation or certification.
Evidence to consider
Attack-surface map, adversarial tests, permission controls and detection/response evidence.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
LLM / agentic security projects
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsInternational / technical framework / Standard / framework
MITRE ATLAS
Security teams analyzing adversarial techniques against AI-enabled systems.
Duties, evidence, limitations & official sources
Status / timing
Published guidance or standard; binding only where adopted
Duties / expectations
Provides a knowledge base of adversary behavior and case studies. Mapping a technique supports threat analysis; it does not demonstrate control effectiveness.
Evidence to consider
Threat models, coverage analysis, exercises and observed detection/containment results.
Scope qualification
Source-review boundary (September 17, 2026): Living catalog; no exhaustive current technique count or identifier validation is claimed.
Source locator
Adversarial Threat Landscape for AI Systems
Review limitation
October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsInternational / technical framework / Standard / framework
OECD AI Principles
Governments and organizations using the OECD policy framework and definitions.
Duties, evidence, limitations & official sources
Status / timing
Published guidance or standard; binding only where adopted
Duties / expectations
Promotes human-centered, transparent, robust and accountable AI. The recommendation is not directly enforceable as a private-sector statute.
Evidence to consider
Principles-to-control mapping, stakeholder review, transparency and accountability mechanisms.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
OECD Recommendation on Artificial Intelligence
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsInternational / technical framework / Standard / framework
Web Content Accessibility Guidelines
Web content and applications; legal incorporation and required level vary by jurisdiction and contract.
Duties, evidence, limitations & official sources
Status / timing
Published guidance or standard; binding only where adopted
Duties / expectations
Provides testable accessibility criteria including keyboard access, focus, contrast and reflow. Automated testing alone is not a complete conformance assessment.
Evidence to consider
Accessibility tests, assistive-technology review, issue remediation and documented scope.
Scope qualification
Applicability requires an entity-, activity- and jurisdiction-specific review.
Source locator
WCAG 2.2
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsInternational - OWASP / Community risk taxonomy
OWASP Top 10 for Agentic Applications 2026
Technical reference for behavioral conformance. Evaluate the sequence of plans, tool requests, retries, delegations and outcomes against an approved operating envelope. A plausible final answer is not evidence that the route taken was authorized.
Duties, evidence, limitations & official sources
Status / timing
Community risk taxonomy, published December 2025; not legislation
Duties / expectations
This entry describes technical guidance or specification context, not a standalone statutory duty. Define expected actions, prohibited means, materiality thresholds and escalation conditions for the use case before granting autonomy.
Evidence to consider
Task and session lineage; tool and policy decisions; versioned evaluation sets and results; quality/permission metrics; exception dispositions; comparisons between claimed completion and the actual system of record.
Scope qualification
Scope reconstructed from the saved v11 crosswalk. This review supports the published orientation summary, not complete legal applicability, implementation certification or every clause of the full instrument.
Source locator
OWASP Top 10 for Agentic Applications 2026
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsInternational - MCP / Technical specification
MCP authorization specification (2026-07-28)
Technical reference for action interlocks. Place enforceable checks between a proposed operation and its side effects. Tool availability, a model request and transport-level access must not be mistaken for business authorization.
Duties, evidence, limitations & official sources
Status / timing
Pinned specification edition; transport authorization is not business-action approval
Duties / expectations
For applicable HTTP-based MCP authorization, validate the token audience, use resource indicators and follow the specified discovery/issuer checks. Tokens must not be placed in query strings or passed through for another resource. Independently authorize the actual tool action, destination, scope and business effect; successful OAuth access is not approval for a payment, disclosure or destructive operation.
Evidence to consider
A tool/version inventory; argument-validation and authorization decisions; action-specific approval; execution receipt and reconciliation; exception or denial records; test evidence for bypass, replay and target substitution.
Scope qualification
Pinned July 28, 2026 reference. Transport authorization and business-action authorization are separate. The site is an educational diagram and does not implement or operate an MCP server.
Source locator
MCP authorization specification (2026-07-28)
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services termsInternational - OpenTelemetry / Technical specification
OpenTelemetry GenAI span conventions
Technical reference for decision evidence. Create an independently protected record connecting the mandate, relevant inputs, versions, policy decisions, actions and observed outcomes. Make uncertainty and missing evidence explicit.
Duties, evidence, limitations & official sources
Status / timing
Technical conventions; many GenAI attributes/operations remain Development stability
Duties / expectations
Pin the semantic-convention revision used by each instrumentation pipeline and test schema changes. Capture trace context, model/version, operation, authorization and outcome metadata as appropriate. Prompt, response and tool-content capture requires a separately justified purpose, access control and retention decision; hashes are not necessarily anonymous.
Evidence to consider
A synchronized event chain; model/tool/policy version identifiers; downstream execution receipts; integrity and access records; collection-gap alerts; retention/hold decisions; disclosed reconstruction limitations.
Scope qualification
Do not assume that fields on a mutable main branch are stable or that OpenTelemetry automatically produces an OCSF mapping. Preserve the mapping/version and validate the evidence pipeline.
Source locator
OpenTelemetry GenAI span conventions
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services termsUnited States - NIST / Guidance
NIST SP 800-218A: AI-model secure development profile
Technical reference for lifecycle accountability. Keep use cases, dependencies, obligations, control owners and material changes under accountable governance from procurement through retirement. Repeatable evidence supports decisions; it does not transfer accountability.
Duties, evidence, limitations & official sources
Status / timing
Final, July 2024; complements SSDF, not a complete deployer compliance standard
Duties / expectations
This entry describes technical guidance or specification context, not a standalone statutory duty. Maintain a use-case register and SBOM/AIBOM scope covering relevant software, models, data, tools, connectors and hosting dependencies. Record known unknowns and validate provenance and critical components.
Evidence to consider
An accountable inventory; applicability analysis; component provenance and validation; release/change approvals; vendor obligations; exception and remediation decisions; board reporting and retirement evidence.
Scope qualification
Scope reconstructed from the saved v11 crosswalk. This review supports the published orientation summary, not complete legal applicability, implementation certification or every clause of the full instrument.
Source locator
NIST SP 800-218A: AI-model secure development profile
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsUnited States - NCCoE / Draft concept paper
NCCoE: software and AI-agent identity and authorization
Technical reference for authority lineage. Keep the initiating person, each delegated agent and the executing service attributable. A handoff should narrow or preserve authorized scope, not silently create new authority.
Duties, evidence, limitations & official sources
Status / timing
NCCoE concept paper, February 2026; not a final practice guide or mandatory standard
Duties / expectations
This entry describes technical guidance or specification context, not a standalone statutory duty. Bind the principal, tenant, task purpose, permitted resources, duration and onward-delegation limits to each handoff.
Evidence to consider
An attributable delegation chain; policy version and decision identifier; requested versus granted scope; credential issuance and expiry; revoked-child and denied-action records. Protect identifiers and tokens: evidence should not become a secrets repository.
Scope qualification
The paper frames software/AI-agent identity and authorization work. Its presence in a crosswalk does not certify an implementation or create a new legal duty.
Source locator
NCCoE: software and AI-agent identity and authorization
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services termsUnited States - CISA / Guidance
CISA / international partners: SBOM for AI minimum elements
Technical reference for lifecycle accountability. Keep use cases, dependencies, obligations, control owners and material changes under accountable governance from procurement through retirement. Repeatable evidence supports decisions; it does not transfer accountability.
Duties, evidence, limitations & official sources
Status / timing
Recommendations, May 12, 2026; not a universal legal mandate; official indexed publication reviewed, full page access restricted
Duties / expectations
This entry describes technical guidance or specification context, not a standalone statutory duty. Maintain a use-case register and SBOM/AIBOM scope covering relevant software, models, data, tools, connectors and hosting dependencies. Record known unknowns and validate provenance and critical components.
Evidence to consider
An accountable inventory; applicability analysis; component provenance and validation; release/change approvals; vendor obligations; exception and remediation decisions; board reporting and retirement evidence.
Scope qualification
Scope reconstructed from the saved v11 crosswalk. Publication identity and described scope only. The full current document was not independently checked.
Source locator
CISA / international partners: SBOM for AI minimum elements
Review limitation
October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsUnited States - CISA / Guidance
CISA: 2026 minimum elements for an SBOM
Technical reference for lifecycle accountability. Keep use cases, dependencies, obligations, control owners and material changes under accountable governance from procurement through retirement. Repeatable evidence supports decisions; it does not transfer accountability.
Duties, evidence, limitations & official sources
Status / timing
Guidance, July 29, 2026; complements, rather than substitutes for, component testing; official indexed publication reviewed, full page access restricted
Duties / expectations
This entry describes technical guidance or specification context, not a standalone statutory duty. Maintain a use-case register and SBOM/AIBOM scope covering relevant software, models, data, tools, connectors and hosting dependencies. Record known unknowns and validate provenance and critical components.
Evidence to consider
An accountable inventory; applicability analysis; component provenance and validation; release/change approvals; vendor obligations; exception and remediation decisions; board reporting and retirement evidence.
Scope qualification
Scope reconstructed from the saved v11 crosswalk. Publication identity and described scope only. The full current document was not independently checked.
Source locator
CISA: 2026 minimum elements for an SBOM
Review limitation
October 13, 2026 source check: the primary page was blocked, unavailable or not machine-readable. The earlier synopsis is retained for orientation, not represented as a newly verified current legal or technical requirement. Validate the current primary text before reliance.
Source check: 2026-10-13 / Text revision: 2026-09-17
Explore related financial-services termsUnited States - California / Law / implementation development
California SB813 - independent AI verification organizations
Establishes a framework for independent verification organizations assessing AI systems/models. Enactment is supported by the official signing announcement.
Duties, evidence, limitations & official sources
Status / timing
Signed September 9, 2026; detailed operative requirements require chaptered-text validation
Duties / expectations
Treat the announcement as an implementation development, not a claim that every AI deployer must immediately purchase an audit. Determine the final covered actors, recognition criteria and implementation dates from the chaptered text.
Evidence to consider
For planning: assessor-independence criteria, evaluation scope, conflict disclosures and procurement review.
Scope qualification
Official signing summary reviewed; chaptered full text and agency implementation not independently verified. No claim that Rich or this site is a state-recognized verifier.
Source locator
SB813 (2025-2026 session)
Review limitation
Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services termsUnited States - California / Law / implementation development
California AB1405 - AI auditor registry and independence
Creates an AI auditor registry and an independence/transparency framework, as described in the official signing announcement.
Duties, evidence, limitations & official sources
Status / timing
Signed September 9, 2026; registry implementation and operative details require validation
Duties / expectations
Do not infer a current registration status or universal enterprise audit obligation. Check the enacted scope, regulator implementation and auditor eligibility before relying on registry language.
Evidence to consider
For planning: qualifications, independence, conflicts, audit-method documentation and accurate representations about registration.
Scope qualification
Signing announcement supports this orientation; the registry's operational status and full statutory text were not independently verified.
Source locator
AB1405 (2025-2026 session)
Review limitation
Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services termsUnited States - California / Executive direction / policy development
California September 2026 AI oversight executive direction
Directs state work on independent oversight and recommendations for stronger frontier-AI safeguards.
Duties, evidence, limitations & official sources
Status / timing
September 18, 2026 executive direction; further proposals are not blanket private-sector mandates
Duties / expectations
The Governor calls for accelerated implementation work and recommendations on independent verification and emergency interruption. Recommendations under consideration are not treated as an already operative universal kill-switch requirement.
Evidence to consider
For planning: monitor agency implementation, interruption testing, independent evidence and clearly assigned response authority.
Scope qualification
Differentiate state-agency directions, enacted law, and potential future private-sector requirements.
Source locator
Executive direction announced September 18, 2026
Review limitation
Source-level review is limited to the available official material; organization-specific applicability and implementing details still require assessment.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services termsUnited States - California / Law / regulation
California Delete Act / DROP data-broker deletion system
Registered data brokers within the Delete Act's scope; not every business maintaining an internal AI dataset is a data broker.
Duties, evidence, limitations & official sources
Status / timing
DROP regulations effective January 1, 2026; broker processing duties started August 1, 2026
Duties / expectations
Covered brokers must access/process DROP requests on the required cycle, generally at least every 45 days, and propagate applicable deletions. Validate exceptions, identity matching and downstream treatment under the final rules.
Evidence to consider
Broker status assessment, request-processing logs, matching/deletion decisions, downstream instructions and exception records.
Scope qualification
This is a broker-specific deletion mechanism, not a substitute for other CCPA rights workflows.
Source locator
Delete Act; DROP regulations
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services termsUnited States - NIST / Concept note / framework development
NIST AI RMF critical-infrastructure profile - concept stage
AI-enabled capabilities used by critical-infrastructure operators.
Duties, evidence, limitations & official sources
Status / timing
Concept note released April 7, 2026; not a final replacement for AI RMF 1.0
Duties / expectations
The NIST project identifies work toward sector-relevant AI risk-management practices. Use published final frameworks as the baseline; label concept material and proposed mappings explicitly.
Evidence to consider
For planning: use-case criticality, safety/continuity dependencies, risk ownership and documented feedback on draft practices.
Scope qualification
Project direction is not a standard, certification or legal obligation.
Source locator
AI RMF Profile for Trustworthy AI in Critical Infrastructure
Review limitation
Source identity and the published orientation were reviewed; this is not an exhaustive clause-level or jurisdiction-specific legal opinion.
Source check: 2026-10-13 / Text revision: 2026-10-13
Explore related financial-services terms